CVE-2023-28361

MEDIUM

6.5

CVSS Score

Published: May 11, 2023 at 12:00 AM UTC

Updated: June 17, 2026 at 05:47 AM UTC

9 products affected across 1 vendorUnifi OSUbiquiti Networks Unifi Dream Machine ProfessionalUbiquiti Networks Unifi Dream Machine

Using UniFi OS by N/A?

Get instant alerts when new vulnerabilities affect UniFi OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by persuading a UniFi OS user to visit a malicious webpage.Affected Products:Cloud Key Gen2Cloud Key Gen2 PlusUNVRUNVR ProfessionalUDMUDM ProfessionalUDM SEUDRMitigation:Update affected products to UniFi OS 3.0.13 or later.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Unifi OS · Uni

95%

v < 3.0.13

Vendor states this is fixed in 3.0.13 (unaffected)

uni-cloud-key-gen2 (environment) · uni-cloud-key-gen2-plus (environment) · uni-ubiquiti-networks-unifi-dream-machine (environment) · uni-ubiquiti-networks-unifi-dream-machine-professional (environment) · uni-ubiquiti-networks-unifi-dream-machine-se (environment) · uni-unifi-dream-router (same device) · uni-unifi-protect-network-video-recorder (same device) · uni-unifi-protect-network-video-recorder-professional (same device)

Cloud Key Gen2 · Unidevice

80%

All versions

Cloud Key Gen2 Plus · Unidevice

80%

All versions

Ubiquiti Networks Unifi Dream Machine · Unidevice

80%

All versions

Ubiquiti Networks Unifi Dream Machine Professional · Unidevice

80%

All versions