UniFi OS CVE-2026-34909

The attacker must have network reachability to the UniFi OS management/web service on the targeted device (per the description's 'access to the network' phrasing and CVSS AV:N), and the CVSS vector PR:N/UI:N confirms no authentication and no user interaction are required. There is no indication that a non-default configuration is needed - any UniFi OS device whose management interface is reachable by the attacker is exploitable, which in typical deployments means anyone on the LAN, on a poorly segmented guest/IoT network, or on the internet if remote management has been exposed. The practical limiter is therefore network exposure of the UniFi OS UI rather than any feature toggle, version edition, or user action; devices kept strictly on an isolated management VLAN are correspondingly harder to reach.

All quantitative signals push this toward top priority: CVSS 3.1 base 10.0 with AV:N/AC:L/PR:N/UI:N indicates a remote, low-complexity, unauthenticated attack with no user interaction, and S:C with C:H/I:H/A:H means a successful exploit crosses a security boundary and yields full impact - consistent with the description's note that the read primitive can be pivoted into account compromise on the underlying OS. However, the description language 'malicious actor with access to the network' suggests the attack surface may be the LAN/management interface rather than the public internet, which softens real-world exposure for users who do not expose UniFi OS management externally. EPSS, KEV, and POC data were not provided in the input, so there is no public exploit identified at time of analysis and no confirmed active exploitation; the fleet-wide footprint and trivial CVSS profile nonetheless warrant emergency patching, particularly for any device where the UniFi OS management UI is reachable from untrusted networks.

An attacker who has reached the same network segment as a UniFi gateway (for example via a guest Wi-Fi, a compromised IoT device, or an exposed WAN-side management port) sends a crafted HTTP request to the UniFi OS web service containing directory-traversal sequences that escape the intended document root. The response leaks sensitive system files - credential stores, tokens, or shadow material - which the attacker then replays or cracks to log in as a privileged underlying account on the device, pivoting from read-only file disclosure to interactive control. No public exploit identified at time of analysis, but the CVSS AC:L/PR:N profile means weaponization once details are public would be straightforward.