EUVD-2026-36381
GHSA-4wqw-89qw-8r56
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Network-reachable management endpoint with no auth or UI (AV:N/AC:L/PR:N/UI:N); path traversal reads files beyond the web component's authority (S:C, C:H); read-only flaw, so I:N/A:N.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtain data from such UniFi OS devices or instances.
Articles & Coverage 1
AnalysisAI
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive data via a path traversal flaw (CWE-22). The high CVSS 8.6 score reflects a scope change with high confidentiality impact, indicating that disclosed data can affect resources beyond the vulnerable component itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the UniFi OS management/web service on an affected device or UniFi OS Server instance - the description specifies 'access to the network', and the CVSS vector confirms AV:N/PR:N/UI:N, so no authentication, user interaction, or special configuration is needed against a default-exposed management interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) describes a high-severity, easily reachable, unauthenticated read-only flaw whose impact extends beyond the vulnerable component (S:C, C:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker positioned on the same network as a UniFi gateway (for example, a guest Wi-Fi client, a compromised IoT device on the LAN, or - where the management interface is internet-exposed - any remote host) sends a crafted HTTP/HTTPS request to a vulnerable UniFi OS endpoint with a path parameter containing '../' sequences. The traversal escapes the intended directory and returns the contents of sensitive files such as configuration backups, credential stores, or session/token material. … |
| Remediation | Patch available per vendor advisory: upgrade affected UniFi OS devices and UniFi OS Server installations to the firmware versions listed in Ubiquiti Security Advisory Bulletin 065 (https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a) - specific fix versions were not included in the supplied input and must be read from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Ubiquiti UniFi OS deployments and document network connectivity paths to identify exposure surface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
Share
External POC / Exploit Code
Leaving vuln.today