EUVD-2026-36384
GHSA-m7hq-4j28-748g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Management plane is network-reachable (AV:N), exploitation is reliable once authenticated (AC:L), a low-privileged UniFi account is required (PR:L), no user interaction, and command execution on UniFi OS pivots to subordinate services (S:C) with full CIA impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to execute a Command Injection within such UniFi OS devices or instances.
Articles & Coverage 2
AnalysisAI
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitrary OS commands on UniFi gateways, controllers, NVRs, and NAS devices, with a CVSS 9.9 score reflecting scope change and full CIA impact. The vulnerability affects a broad device family including UDM, UDM Pro/SE/Max/Beast, UDR, UDW, UCG, UNVR, and UNAS lines per Ubiquiti Security Advisory Bulletin 065. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
Technical ContextAI
UniFi OS is the Linux-based operating system that powers Ubiquiti's gateway, controller, NVR, and NAS appliances; it exposes a unified management web UI and REST APIs that proxy operator-supplied parameters to underlying system tooling. The root cause is CWE-20 (Improper Input Validation): user-controlled input received over the management plane is not adequately sanitized before being incorporated into a command invocation, allowing shell metacharacters or argument injection to break out into the underlying shell. Because UniFi OS consoles host management daemons that frequently run with elevated privileges and bridge to subordinate UniFi network and protect services, a successful injection on the OS layer can pivot beyond the immediate process - consistent with the CVSS Scope:Changed designation.
RemediationAI
Patch available per vendor advisory: update each affected UniFi OS console, server, NVR, NAS, and Cloud Gateway/Cloud Key device to the fixed UniFi OS firmware listed in Ubiquiti Security Advisory Bulletin 065 at https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a; exact patched version numbers should be taken from that advisory. Until devices are upgraded, restrict the UniFi OS management UI and APIs to trusted management VLANs or VPN-only access, disable any internet-exposed remote-access/port-forwarding to the controller (port 443/8443), audit and remove unnecessary low-privileged local accounts, rotate credentials for any account that may have been shared with untrusted operators, and enable MFA on Ubiquiti SSO - noting that the trade-off of locking down the management plane is loss of casual remote administration via the public UI.
More in Unifi Os Server
View allUnauthenticated command injection in Ubiquiti UniFi OS devices allows remote attackers with network access to execute ar
Path traversal in Ubiquiti UniFi OS devices allows network-adjacent attackers to read sensitive files from the underlyin
Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configur
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
Command injection in Ubiquiti UniFi OS devices allows a high-privileged attacker on the network to execute arbitrary ope
Command injection in Ubiquiti UniFi OS (all builds before 5.1.19) lets a low-privileged user on the same network run arb
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged, network-adjacent user to chain a series of authentica
Privilege escalation via Server-Side Request Forgery affects Ubiquiti UniFi OS devices and the UniFi OS Server across th
Authentication bypass in Ubiquiti UniFi OS devices allows a network-adjacent attacker to abuse a path traversal flaw (CW
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive
Path traversal in Ubiquiti UniFi OS devices allows authenticated low-privileged network attackers to read arbitrary file
Cross-site session abuse in Ubiquiti UniFi OS lets a remote attacker who lures an authenticated operator to a malicious
Same weakness CWE-20 – Improper Input Validation
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today