Ubiquity, a networking and video surveillance camera manufacturer, has corrected a flaw that users claim gave them unauthorized access to other customers’ accounts and private live video feeds.
Some consumers, according to reports on Reddit, got push alerts on their phones with Ubiquiti account-related information and private video streams belonging to other customers. Another user said that when they signed into their Ubiquiti account, they were provided with the account information of another customer.
“I logged in, and I seem to be someone else,” one user on the Ubiquiti subreddit said. Another claimed to have “full access” to dozens of consoles that did not belong to them.
Ubiquiti is a cloud and technology firm that manufactures routers, network switches, security, and video surveillance equipment that can be monitored and operated remotely via its centralized cloud service.
Ubiquiti later said on its community forum that it has “identified—and addressed—the cause of this problem,” which it claimed was caused by an update to its cloud infrastructure.
“We were made aware of a small number of instances where users received push notifications on their mobile devices that appeared to come from unknown consoles, or where such users were able to access consoles that didn’t appear to be their own,” wrote a person who wishes to remain anonymous.
According to the firm, 1,216 accounts from one group were incorrectly paired with another group of 1,177 accounts on December 13, and the mixed access lasted around nine hours.
While this looks to be a mistake rather than a criminal occurrence—and errors happen—it serves as a reminder that Ubiquiti still has extensive access to and control over its customers’ devices and data.
