EUVD-2026-41384
GHSA-fp2c-q39c-97j4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable authenticated low-priv user (PR:L) triggers low-complexity command injection escaping the app to the host (S:C), yielding full C/I/A host compromise.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.
Articles & Coverage 1
AnalysisAI
Command injection in Ubiquiti's UniFi Access Application lets a low-privileged attacker with network reach run arbitrary OS commands on the underlying host device, escaping the application into the operating system (CVSS 9.9, scope-changed). Improper input validation (CWE-20) means attacker-supplied data reaches a shell context; there is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. Reported through HackerOne and addressed in Ubiquiti Security Advisory Bulletin 066.
Technical ContextAI
UniFi Access is Ubiquiti's cloud-managed physical access-control platform (door readers, hubs, and the management application) that runs on UniFi host hardware such as UniFi OS Consoles/gateways. The root cause is CWE-20 Improper Input Validation: application input that should be treated as data is instead passed into a command/shell execution path on the host, yielding OS command injection. Because the injected command executes in the host operating system rather than inside the application sandbox, the CVSS scope is Changed (S:C) - the vulnerable component (the Access application) is used to compromise a different security authority (the host device). The affected component is identified in CPE as cpe:2.3:a:ubiquiti_inc:unifi_access_application, indicating the application layer of the product is the vulnerable surface.
RemediationAI
Patch available per vendor advisory - upgrade the UniFi Access Application to the fixed release described in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); the exact fixed version is not stated in the available data, so confirm the target build in that bulletin before scheduling the upgrade. Because exploitation requires network reachability plus low-privileged access, compensating controls until patched include restricting network access to the UniFi Access management interface and host to trusted administrative VLANs or management networks (limiting who can reach the low-privilege surface), tightening and auditing application account credentials to reduce the pool of low-privilege actors, and monitoring the host for anomalous process/command execution. These controls reduce reachability but do not remove the underlying injection, so patching remains the only complete fix.
More in Unifi Access Application
View allCommand injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network access to run arb
OS command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network reach to run a
Command injection in Ubiquiti's UniFi Access Application allows an authenticated attacker with low privileges and networ
Privilege escalation in Ubiquiti's UniFi Access Application allows a network-adjacent attacker holding only low-privileg
Privilege escalation in Ubiquiti's UniFi Access Application allows an attacker who already holds high privileges and net
Arbitrary file disclosure in Ubiquiti's UniFi Access Application allows a network-adjacent, unauthenticated attacker to
Same weakness CWE-20 – Improper Input Validation
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today