What’s Vulnerable › Vulnerabilities

CVE-2020-8148

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-13 · updated 2026-06-17
• Weakness: CWE-287

Description

UniFi Cloud Key firmware < 1.1.6 contains a vulnerability that enables an attacker being able to change a device hostname by sending a malicious API request. This affects Cloud Key gen2 and Cloud Key gen2 Plus.

Affected products

• Ui Cloud Key Gen2: through 1.1.6
• Ui Cloud Key Gen2 Plus: through 1.1.6

References

• https://community.ui.com/releases/Security-advisory-bulletin-007-007/eb639fa0-68ad-4bf5-9663-3b760eb2f93a
• https://hackerone.com/reports/802079
• https://community.ui.com/releases/Security-advisory-bulletin-007-007/eb639fa0-68ad-4bf5-9663-3b760eb2f93a
• https://hackerone.com/reports/802079

Get alerted when CVE-2020-8148 or the next vulnerability affects your stack