TI-2023-12702 Aliases CVE-2023-28123 GHSA-668p-6wx6-xp5r

Incorrect permission assignment in UI Desktop for Windows

LOW 24CWE-732Published 2023-04-19 · Updated 2025-02-05

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

A permission misconfiguration in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow an user to hijack VPN credentials while UID VPN is starting.This vulnerability is fixed in Version 0.62.3 and later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00163 5th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	UI Desktop for Windows	Fixed on Version 0.62.3 or later.	—	No fix listed	CNA

UI Desktop for Windows Vendor— Affected Fixed on Version 0.62.3 or later. Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ui:desktop::::::windows::*	before 0.62.3.0	Vulnerable	Ubiquiti

cpe:2.3:a:ui:desktop:*:*:*:*:*:windows:*:* Versions before 0.62.3.0 Vulnerable ·Ubiquiti

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-28123
2026-10-03 Alias added: GHSA-668p-6wx6-xp5r

References

Advisory 1

https://community.ui.com/releases/Security-Advisory-Bulletin-029-029/a47c68f2-1f3a-47c3-b577-eb70599644e4

TI-2023-12701 Improper privilege management in UI Desktop for Windows CVSS 3.1HIGH 7.8
TI-2022-15936 Improper privilege management in UI Desktop for Windows CVSS 3.1HIGH 7.8
TI-2023-12703 Improper usage of symmetric encryption in UI Desktop for Windows (Version 0.59.1.71 and… CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences