EUVD-2026-36378
GHSA-x48g-g9fg-6pfc
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N) but only exploitable under specific non-default network configurations (AC:H); unauthorized config changes yield high integrity/availability but limited direct data disclosure (C:L).
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.
Articles & Coverage 1
AnalysisAI
Improper access control in Ubiquiti UniFi OS allows network-adjacent attackers to make unauthorized configuration changes to UniFi Dream Machine, Cloud Gateway, and Express gateway devices under certain network configurations. The flaw, scored CVSS 8.1 with full CIA impact, requires no authentication (PR:N) but has high attack complexity (AC:H), and no public exploit identified at time of analysis. Disclosed via HackerOne and addressed in Ubiquiti Security Advisory Bulletin 065.
Technical ContextAI
UniFi OS is the embedded Linux-based operating system that powers Ubiquiti's Dream Machine (UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast), Cloud Gateway (UCG Ultra, UCG Max, UCG Fiber, UCG Industrial), Express (EFG, Express 7), Dream Wall (UDW), and Dream Router (UDR, UDR7, UDR-5G) appliances, providing routing, switching, Wi-Fi controller, and management plane services. The root cause is CWE-284 (Improper Access Control), meaning the device fails to correctly enforce authorization on one or more management or control-plane interfaces reachable over the network. Because UniFi OS exposes both LAN-side admin services and inter-device protocols (adoption, discovery, controller comms), an access-control gap on any of those surfaces can let an unauthenticated peer on the same network issue privileged operations against the appliance.
RemediationAI
Patch available per vendor advisory - apply the UniFi OS firmware update referenced in Ubiquiti Security Advisory Bulletin 065 (https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a) to every affected UDM, UDR, UDW, EFG, Express, and UCG model in the fleet; exact fix version per device family is not reproduced in the supplied data and should be taken from the bulletin. Until patches are deployed, restrict layer-2/layer-3 reachability to the gateway's management and inter-device control surfaces by placing untrusted clients, IoT, and guest SSIDs on isolated VLANs that cannot reach the gateway's LAN-side admin and adoption ports (note: this can break local controller features and device adoption from those segments), and disable any cross-network management exposure such as remote-site discovery if not strictly required. Ensure UniFi remote-access (Site Manager / cloud) is gated by SSO/MFA and audit admin accounts; these are compensating controls, not substitutes for the firmware update.
Unauthenticated command injection in Ubiquiti UniFi OS devices allows remote attackers with network access to execute ar
Path traversal in Ubiquiti UniFi OS devices allows network-adjacent attackers to read sensitive files from the underlyin
Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configur
free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile co
free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile co
Remote attackers can inject control characters into the SUPI parameter of free5GC UDM versions up to 1.4.1, causing URL
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile co
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive
Path traversal in Ubiquiti UniFi OS devices allows authenticated low-privileged network attackers to read arbitrary file
pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today