CVE-2020-8188

We have recently released new version of UniFi Protect firmware v1.13.3 and v1.14.10 for Unifi Cloud Key Gen2 Plus and UniFi Dream Machine Pro/UNVR respectively that fixes vulnerabilities found on Protect firmware v1.13.2, v1.14.9 and prior according to the description below:View only users can run certain custom commands which allows them to assign themselves unauthorized roles and escalate their privileges.

• CWE-77
• CWE-78

• https://community.ui.com/releases/Security-advisory-bulletin-012-012/1bba9134-f888-4010-81c0-b0dd53b9bda4Vendor Advisory
• https://community.ui.com/releases/UniFi-Protect-1-13-3/f4be7d35-93a3-422b-8eef-122e442c00baRelease Notes, Vendor Advisory
• https://community.ui.com/releases/UniFi-Protect-1-14-10/48a8dbdd-b872-47fa-bbde-1d24ddf5d5b5Release Notes, Vendor Advisory
• https://community.ui.com/releases/Security-advisory-bulletin-012-012/1bba9134-f888-4010-81c0-b0dd53b9bda4Vendor Advisory
• https://community.ui.com/releases/UniFi-Protect-1-13-3/f4be7d35-93a3-422b-8eef-122e442c00baRelease Notes, Vendor Advisory
• https://community.ui.com/releases/UniFi-Protect-1-14-10/48a8dbdd-b872-47fa-bbde-1d24ddf5d5b5Release Notes, Vendor Advisory

Published

Jul 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8182Improper access control in Nextcloud Deck 0.8.0 allowed an a…8
• CVE-2020-8183A logic error in Nextcloud Server 19.0.0 caused a plaintext …7.5
• CVE-2020-8184A reliance on cookies without validation/integrity check sec…7.5
• CVE-2020-8185A denial of service vulnerability exists in Rails <6.0.3.2 t…6.5
• CVE-2020-8186A command injection vulnerability in the `devcert` module ma…9.8
• CVE-2020-8187Improper input validation in Citrix ADC and Citrix Gateway v…7.5
• CVE-2020-8189A cross-site scripting error in Nextcloud Desktop client 2.6…5.4
• CVE-2020-8190Incorrect file permissions in Citrix ADC and Citrix Gateway …7.5
• CVE-2020-8191Improper input validation in Citrix ADC and Citrix Gateway v…6.1
• CVE-2020-8192A denial of service vulnerability exists in Fastify v2.14.1 …6.5
• CVE-2020-8193Improper access control in Citrix ADC and Citrix Gateway ver…6.5
• CVE-2020-8194Reflected code injection in Citrix ADC and Citrix Gateway ve…6.5