EUVD-2026-31383
GHSA-p8c5-xwrc-584f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (hackerone) · only source for this CVE.
CVSS VectorVendor: hackerone
Lifecycle Timeline
3DescriptionCVE.org
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
Articles & Coverage 1
AnalysisAI
Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configuration without authentication, affecting a broad range of UniFi gateways, dream machines, NVRs, NAS units, and cloud keys. The maximum CVSS 10.0 score reflects network-reachable, unauthenticated exploitation with scope change and full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis, but the authentication bypass nature elevates urgency for any UniFi management plane exposed beyond trusted segments.
Technical ContextAI
UniFi OS is Ubiquiti's unified operating system that runs on the UDM (Dream Machine) line, UDR routers, UCG cloud gateways, UCK/UCKP cloud keys, UNVR network video recorders, UNAS storage appliances, and the EFG/UDW edge platforms. The flaw is classified as CWE-284 (Improper Access Control), meaning authorization checks for privileged system-modifying operations are missing or bypassable. The CVSS scope change (S:C) signals that exploitation crosses a trust boundary - the affected component can influence resources beyond its own security authority, which on a converged network appliance like UniFi OS typically means routing, firewall, VPN, or camera/storage subsystems controlled by the same management plane.
RemediationAI
Patch available per vendor advisory - consult Ubiquiti Security Advisory Bulletin 064 at https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b for the exact fixed UniFi OS firmware version for each device model, as the input does not enumerate fix versions. Until firmware can be applied, restrict the UniFi OS management interface (typically TCP 443 and 8443) to a dedicated management VLAN or VPN, and ensure WAN-side management is disabled - note that disabling remote access will break Ubiquiti's UI.com cloud SSO workflow for off-network admins. As a compensating control, place the controller behind a firewall rule that allows only known admin IPs to reach the web UI; this does not prevent lateral movement from a compromised internal host but eliminates external exposure.
More in Unifi Os Server
View allUnauthenticated command injection in Ubiquiti UniFi OS devices allows remote attackers with network access to execute ar
Path traversal in Ubiquiti UniFi OS devices allows network-adjacent attackers to read sensitive files from the underlyin
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
Command injection in Ubiquiti UniFi OS Server allows an attacker holding high-privilege access and network reachability
Command injection in Ubiquiti UniFi OS Server allows an attacker holding high-privilege (administrative) access on the n
Command injection in Ubiquiti UniFi OS devices allows a high-privileged attacker on the network to execute arbitrary ope
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances runni
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today