External risk intelligence

UniFi APs and Switches SNMP Integer Overflow Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-35085

The vulnerability affects network infrastructure devices (Access Points and Switches) via SNMP. While these are network-reachable in internal environments, they are typically managed within private, isolated administrative segments and are rarely exposed directly to the public internet in standard deployment patterns.

Integer Overflow

Ui Unifi Uap Firmware

6.5.50 and earlier6.5.32 and earlier

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts UniFi networking devices, specifically access points and switches, with a critical flaw that could allow remote code execution if the SNMP monitoring feature is enabled. While the potential for remote code execution is severe, its exploitation typically requires specific network configurations and default settings to be active.

Network devices have a critical remote execution flaw.
This could affect internal network integrity.
Confirm device exposure and update if needed.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by targeting UniFi Access Points or Switches over the network. If SNMP monitoring is enabled with default settings, the attacker can send specially crafted data that causes an integer overflow, potentially leading to remote code execution.

Network access to the device is required.
SNMP monitoring with default settings must be enabled.
Risk includes remote code execution on the device.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary code on affected UniFi Access Points and Switches when SNMP monitoring is enabled with default settings. This could potentially compromise the security and operation of the network devices.

Network devices could be compromised.
Remote code execution may occur.
Network integrity could be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

For organizations using UniFi Access Points and Switches, the platform or network infrastructure teams are likely responsible for addressing this vulnerability. The first practical step is to inventory all UniFi devices, confirm if SNMP monitoring is enabled, and determine if these devices are accessible from untrusted networks or are business-critical. Once accountable owners are identified, remediation can be planned based on the assessed risk.

Network and Platform Teams own resolution.
Verify SNMP enabled and network exposure.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What are UniFi Access Points and Switches used for?

UniFi devices are networking hardware used to manage connectivity in homes and businesses. Access points provide wireless internet coverage, while switches serve as the central connection hubs that route data between various wired devices in a network infrastructure.

What does integer overflow mean for CVE-2023-35085?

This vulnerability is an integer overflow, classified as CWE-190. It occurs when a software calculation exceeds the storage capacity of a number, causing the program to wrap around to an incorrect value. In this case, an attacker can use this flaw to trigger a remote code execution, essentially forcing the device to run unauthorized commands.

How can an attacker trigger this vulnerability?

An attacker needs network access to the device and must specifically target the SNMP (Simple Network Management Protocol) monitoring feature while it is configured with default settings. If SNMP is disabled or not using default parameters, the specific trigger path for this integer overflow does not function.

Is my network at risk from this vulnerability?

Halo Surface Signal identifies this as having an 'Unlikely' risk profile because these devices are typically kept in private, isolated administrative network segments. While the flaw allows for remote code execution, it is rarely exposed directly to the public internet, which limits the potential for unauthorized external access.

How do I secure my UniFi devices?

The most effective way to address this is by updating your firmware. You should update your UniFi Access Points to version 6.5.62 or later, and your UniFi Switches to version 6.5.59 or later. Before updating, verify your current SNMP configuration settings to ensure you are managing the risk on all active devices.

References

community.ui.com/releases/Security-Advisory-Bulletin-035-035/91107858-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.