Ubiquiti G4 Vulnerability Discovered, Enabling DDoS Attacks

Researchers found a flaw in Ubiquiti G4 Wi-Fi cameras that exposes critical data. They believe a similar vulnerability was used in 2019 for DoS attacks on many cameras. Despite Ubiquiti’s claims of a fix, many devices remain vulnerable.

Ubiquiti G4 Vulnerability

Researchers found two privileged processes in Ubiquiti G4 cameras exposed to the Internet via UDP, allowing information dumping and potential DoS attacks or device compromise.

Using UDP protocols 10001 and 7004, CheckPoint’s research team accessed the camera’s discovery protocol. The camera responded with information such as software version, IP address, and platform name without authentication, exposing sensitive details about the device owner and company.

Another key detail is that the response packet from the camera is much larger than the input packet, enabling amplification and reflected DDoS attacks.

By sending ping requests with a spoofed sender IP, attackers can direct the large response to a target network or system for a DDoS attack. This also creates load on the cameras, opening the door for additional attack scenarios.

Rapid7 found half a million vulnerable devices in 2019, but the CPR team located only 20,000 now. Despite the lower number, the availability of free devices for Reflect DDoS attacks remains a concern. Hackers usually pay for botnets, so they won’t miss this free opportunity.

For device owners, not updating firmware is irresponsible. The base flaw, CVE-2017-0938, was fixed by Ubiquiti years ago.

Having outdated firmware in 2019 was concerning, but in 2024, it’s unacceptable.

Besides the DDoS risk, there’s also a privacy issue, as hackers can gather information about the owner and plan further attacks on the internal network.