UniFi OS CVE-2026-34910

The attacker requires network reachability to the UniFi OS management/web service on an affected device (UDM, UCG, UCK, UNVR, UNAS, Express, EFG, UDW, UDR variants running UniFi OS); per CVSS PR:N and UI:N no credentials and no user interaction are required, and the default-listening management interface is the attack surface. Practical limiting factor: UniFi OS administration is typically bound to LAN/management interfaces rather than the WAN, so direct internet exploitation generally requires that an operator has port-forwarded or otherwise exposed the management UI, while LAN-resident attackers (including guest-network clients if not properly segmented and any compromised internal host) can reach it under default deployments. No vulnerable feature toggle, non-default mode, or specific firmware build is called out in the description as a precondition - the vendor states only that network access to the device is sufficient.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H is the worst-case profile - network-reachable, low complexity, no privileges, no user interaction, and total compromise with scope change - yielding the maximum 10.0 score. However, several mitigating signals temper real-world urgency: the issue is not in CISA KEV, no EPSS score was supplied, no POC is referenced, and the vendor advisory wording 'a malicious actor with access to the network' may indicate the management interface is not expected to be exposed to the open internet by default (UniFi OS web UI typically listens on LAN/management interfaces). If an operator has exposed UniFi OS administration to untrusted networks, this is an immediate priority; for LAN-only deployments the practical risk drops to an insider/lateral-movement scenario but remains critical because compromise of a UniFi gateway yields root on the network perimeter. EPSS data is missing, so probabilistic exploitation likelihood cannot be quantified from the provided inputs.

An attacker on the same LAN as a UniFi gateway - for example, a guest Wi-Fi user, a compromised IoT device, or an insider - sends an HTTP request to the UniFi OS web service with a parameter containing shell metacharacters that the backend passes unsanitized to a system command, gaining root-equivalent code execution on the appliance. From there the attacker can pivot into the management VLAN, dump controller credentials, modify firewall rules to expose internal services, or backdoor firmware to persist across reboots. No public exploit identified at time of analysis, but the CVSS profile (AV:N/AC:L/PR:N/UI:N) implies a single-request exploitation primitive once the vulnerable parameter is identified.