High severity7.5NVD Advisory· Published Oct 27, 2020· Updated Jun 17, 2026

CVE-2020-27888

Description

An issue was discovered on Ubiquiti UniFi Meshing Access Point UAP-AC-M 4.3.21.11325 and UniFi Controller 6.0.28 devices. Cached credentials are not erased from an access point returning wirelessly from a disconnected state. This may provide unintended network access.

Affected products

UI/Unifi Controller Firmware
cpe:2.3:o:ui:unifi_controller_firmware:6.0.28:*:*:*:*:*:*:*
UI/Unifi Meshing Access Point Firmware
cpe:2.3:o:ui:unifi_meshing_access_point_firmware:4.3.21.11325:*:*:*:*:*:*:*
Ubiquiti/UniFi Meshing Access Point UAP-AC-Mdescription
Ubiquiti Inc/UniFi Video Controllerllm-fuzzy
Range: 6.0.28
Ubiquiti Inc/UniFi U6+ Access Pointllm-fuzzy
Range: 4.3.21.11325

Patches

Vulnerability mechanics

References

community.ui.com/questions/Possible-authentication-bypass-for-access-into-LAN/7965adb2-5d70-4410-8467-4c7bec76bc00nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000