Ubiquiti acknowledges error where users gained access to someone else’s account

Ubiquiti acknowledges that on December 13, approximately 1,200 users briefly had unauthorized access to other users’ accounts. An update to the UniFi Cloud infrastructure caused the problem, which the company says has now been resolved.

Source: Reddit

In a community blog post the tech company explains that two groups of users were affected by the UniFi Cloud misconfiguration. The accounts of a group of more than 1,200 users were incorrectly linked to the accounts of a second group of just under 1,200 other users. Affected users in some cases received a notification from other users’ devices and sometimes had access to someone else’s account when logging in with their Ubiquiti account. Unlike the recent problems surrounding access to Eufy cameras, Ubiquiti does not appear to be a structural problem, but an incident.

A user on Reddit shows with screenshots that unauthorized access to other people’s cameras was possible. Another user shows on the Ubiquity forum how he accessed someone else’s account and thus 88 devices that did not belong to the user.

According to Ubiquiti, the latter person is one of a few users who actually unauthorized access to someone else’s account. The company reports that just under 2,400 users in total were affected, but that only a dozen users are estimated to have actively ‘exploited’ the misconfiguration. Ubiquiti says it plans to inform those affected about the incident.