Security readout for executives and security teams
Plain-English summary
CVE-2020-8267 is an authentication flaw in UniFi Protect. Affected controllers could accept API messages as authenticated even without a valid token. For organizations using UniFi Protect for physical security video operations, this creates unauthorized control-plane risk. Ubiquiti says the issue is fixed in UniFi Protect 1.14.11 and newer.
Executive priority
Patch promptly where UniFi Protect supports business-critical surveillance or site security. Escalate priority if the controller API is reachable beyond trusted administrative networks. The absence of KEV evidence lowers emergency pressure, but authentication bypass on security infrastructure warrants timely remediation.
Technical view
UniFi Protect controller 1.14.10 and earlier improperly used the API x-token authentication mechanism, allowing authenticated API messages without a valid token. The CVE maps to CWE-287. Affected platforms listed are UDM-Pro firmware 1.7.2 and earlier, and UNVR firmware 1.3.12 and earlier.
Likely exposure
Exposure is limited to environments running affected UniFi Protect versions on UDM-Pro or UNVR. UniFi Cloud Key Gen 2 Plus is stated as not impacted. UDM-Pro customers with UniFi Protect stopped are also stated as not impacted.
Exploitation context
The provided sources do not report active exploitation, public exploit use, or KEV listing. They only describe the authentication weakness and affected versions. Risk depends on whether the UniFi Protect controller API is reachable by an attacker.
Researcher notes
Source detail is sparse: no CVSS vector, no endpoint specifics, and no exploit preconditions beyond improper x-token handling. Avoid assuming device takeover or data exposure without further vendor evidence. Validation should focus on exact product, firmware, controller version, and whether Protect is running.
Mitigation direction
- Update UniFi Protect to version 1.14.11 or newer through UniFi OS settings.
- Alternatively update UNVR firmware to 1.3.15 or newer.
- Alternatively update UDM-Pro firmware to 1.8.0 or newer.
- Confirm UniFi Protect is stopped on UDM-Pro systems where it is not used.
- Check current Ubiquiti guidance before changing production security systems.
Validation and detection
- Inventory UDM-Pro and UNVR devices running UniFi Protect.
- Verify UniFi Protect controller version is 1.14.11 or newer.
- Verify UNVR firmware is 1.3.15 or newer where applicable.
- Verify UDM-Pro firmware is 1.8.0 or newer where applicable.
- Confirm Cloud Key Gen 2 Plus assets are not misclassified as affected.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-287: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-8267 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://community.ui.com/releases/UniFi-Protect-1-14-11/928e6fac-afeb-49c2-93a5-1b3066bf2bbfCVE reference · x_refsource_MISC
- https://community.ui.com/releases/UniFi-Protect-NVR-Firmware-1-3-15/c2a783a6-c996-43d9-ab95-8c97ae05a98fCVE reference · x_refsource_MISC
- https://community.ui.com/releases/UniFi-Dream-Machine-Firmware-1-8-0/deabc255-a081-49ba-8f51-131f3a13000aCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authentication
Improper Authentication represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.