EUVD-2026-36378
GHSA-x48g-g9fg-6pfc
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N) but only exploitable under specific non-default network configurations (AC:H); unauthorized config changes yield high integrity/availability but limited direct data disclosure (C:L).
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.
Articles & Coverage 1
AnalysisAI
Improper access control in Ubiquiti UniFi OS allows network-adjacent attackers to make unauthorized configuration changes to UniFi Dream Machine, Cloud Gateway, and Express gateway devices under certain network configurations. The flaw, scored CVSS 8.1 with full CIA impact, requires no authentication (PR:N) but has high attack complexity (AC:H), and no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to have network reachability to a vulnerable UniFi OS gateway (UDM/UDR/UDW/EFG/UCG/Express family) AND for that gateway to be running 'certain network configurations' as stated by Ubiquiti - the specific triggering configuration is not disclosed in the advisory text supplied, which is itself a limiting factor and a data gap. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H yields 8.1 (High) - full impact with no authentication required, but AC:H signals that successful exploitation depends on a non-default condition (the description's 'under certain network configurations'). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a foothold on a network segment that can reach a vulnerable UniFi gateway - for example, via a compromised guest-VLAN device, a rogue IoT endpoint, or a malicious insider on the LAN - sends crafted traffic to the device's management or control-plane service and, because access control is improperly enforced, applies unauthorized configuration changes (e.g., disabling firewall rules, adding port forwards, or pushing rogue settings) without ever authenticating. No public exploit is identified at time of analysis, and the AC:H rating implies the attacker must first identify or induce the specific vulnerable network configuration before the request succeeds. |
| Remediation | Patch available per vendor advisory - apply the UniFi OS firmware update referenced in Ubiquiti Security Advisory Bulletin 065 (https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a) to every affected UDM, UDR, UDW, EFG, Express, and UCG model in the fleet; exact fix version per device family is not reproduced in the supplied data and should be taken from the bulletin. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all UniFi OS devices in production and segment management interfaces to trusted networks only using VLANs and access control lists. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive
Share
External POC / Exploit Code
Leaving vuln.today