How severe is CVE-2020-8145?

CVE-2020-8145 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2020-8145 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (62nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-8145?

CVE-2020-8145 affects Ui Unifi Video. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-8145?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-8145 published?

CVE-2020-8145 was published on 2020-04-01 and last updated on 2026-06-17.

CVE-2020-8145

CVE-2020-8145 is a medium-severity vulnerability in Ui Unifi Video with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 4.0
EPSS exploit prediction: 1% (62nd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Ui Unifi Video
Published: 2020-04-01
Last modified: 2026-06-17

Description

The UniFi Video Server (Windows) web interface configuration restore functionality at the “backup” and “wizard” endpoints does not implement sufficient privilege checks. Low privileged users, belonging to the PUBLIC_GROUP or CUSTOM_GROUP groups, can access these endpoints and overwrite the current application configuration. This can be abused for various purposes, including adding new administrative users. Affected Products: UniFi Video Controller v3.9.3 (for Windows 7/8/10 x64) and prior. Fixed in UniFi Video Controller v3.9.6 and newer.

Frequently asked questions

What is CVE-2020-8145?: The UniFi Video Server (Windows) web interface configuration restore functionality at the “backup” and “wizard” endpoints does not implement sufficient privilege checks. Low privileged users, belonging to the PUBLIC_GROUP or CUSTOM_GROUP groups, can access these endpoints and overwrite the current application configuration. This can be abused for various purposes, including adding new administrative users. Affected Products: UniFi Video Controller v3.9.3 (for Windows 7/8/10 x64) and prior. Fixed in UniFi Video Controller v3.9.6 and newer.
How severe is CVE-2020-8145?: CVE-2020-8145 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2020-8145 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (62nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-8145?: CVE-2020-8145 affects Ui Unifi Video. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-8145?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-8145 published?: CVE-2020-8145 was published on 2020-04-01 and last updated on 2026-06-17.

References

https://community.ui.com/releases/Security-advisory-bulletin-006-006/3cf6264e-e0e6-4e26-a331-1d271f84673e

Affected products (1)

cpe:2.3:a:ui:unifi_video:*:*:*:*:*:*:*:*