External risk intelligence

UniFi Access Points and Switches Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-38034

The vulnerability exists in the DHCP client function of UniFi Access Points and Switches. DHCP clients operate on the local network segment (Layer 2) to obtain IP addresses from a local DHCP server. They are not designed to be exposed directly to the public internet, and such exposure would require misconfiguration or unusual network architecture.

Command Injection

Ui Unifi Uap Firmware

6.5.53 and earlier6.5.32 and earlier

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical command injection vulnerability has been identified in the DHCP client functionality of UniFi Access Points and Switches, excluding the Switch Flex Mini. This issue could potentially allow unauthorized remote code execution, impacting network infrastructure security.

Network devices have a critical security flaw.
Critical flaws in network devices can pose significant risks.
Confirm relevance and exposure of affected devices.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network packets to vulnerable UniFi devices. The attack targets the DHCP client function, which is designed to communicate with a DHCP server to obtain network configuration. If successful, an attacker could gain the ability to execute arbitrary code on the device, potentially leading to broader network compromise.

Entry via network exposure.
Triggered by crafted DHCP packets.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A command injection vulnerability in the DHCP Client function of certain UniFi Access Points and Switches could allow remote code execution. This could affect the device's operation and potentially the network it manages, under conditions where an attacker can interact with the DHCP client.

Network device functions at risk.
Malicious DHCP responses could trigger execution.
Compromise of device and network control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for UniFi Access Points and Switches should prioritize understanding their exposure to this command injection vulnerability. The initial step involves inventorying all affected devices, determining their network reachability, and identifying their business criticality to accurately assess risk. Once ownership is confirmed, a remediation plan can be developed.

Confirm device inventory and reachability.
Identify accountable asset owners.
Plan phased remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the function of UniFi Access Points and Switches?

UniFi Access Points and Switches are networking hardware used to create, manage, and expand local area networks. Access Points provide wireless connectivity for devices, while Switches connect multiple wired devices like computers and printers together. These components rely on firmware to handle network traffic and configuration tasks, such as automatically requesting an IP address from a server.

What does command injection mean for CVE-2023-38034?

This vulnerability is classified as CWE-77, or Improper Neutralization of Special Elements used in a Command. In simple terms, the device's DHCP client software fails to properly check incoming data. Because of this, an attacker can send a specially crafted network packet that the device mistakenly interprets as a legitimate system command, allowing the attacker to run unauthorized code.

How is this vulnerability triggered by an attacker?

An attacker triggers this flaw by sending malicious data to the device's DHCP client. The DHCP client is the part of the software that asks a server for network settings. It is important to note that sending standard, legitimate network traffic or normal DHCP requests does not trigger this issue; the exploit specifically requires the injection of specially crafted data designed to force the device to execute malicious instructions.

How relevant is CVE-2023-38034 if devices are internal?

According to Halo Surface Signal, this vulnerability is unlikely to be reached from the public internet. Because DHCP clients operate on the local network segment, an attacker typically needs to be on your local network to send the necessary packets. If your UniFi devices are properly configured and not exposed directly to the internet, the risk of external exploitation is significantly reduced.

What are the first steps to fix this vulnerability?

To address this, identify all UniFi hardware in your environment and compare their firmware versions against the advisory. Access Points should be updated to version 6.5.62 or later, and Switches should be updated to version 6.5.59 or later, with the exception of the Switch Flex Mini, which is not affected. Prioritize these updates on devices that manage critical parts of your network infrastructure.

References

community.ui.com/releases/Security-Advisory-Bulletin-035-035/91107858-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.