EUVD-2026-41392
GHSA-j9mg-7mrv-2wwc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable SSRF exploitable by an authenticated low-privileged user (PR:L, AV:N, AC:L, UI:N) yielding privilege escalation confined to the device (S:U) with high C/I/A; SSVC 'partial' impact adds mild uncertainty to the H ratings.
Primary rating from Vendor (hackerone).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.
AnalysisAI
Privilege escalation via Server-Side Request Forgery affects Ubiquiti UniFi OS devices and the UniFi OS Server across the Dream Machine, Dream Router, Cloud Gateway, Cloud Key, Enterprise Fortress/Firewall, and NVR/EVR product lines running versions below 5.1.19. A low-privileged user with network access can coerce the device into making attacker-controlled internal requests, leveraging the SSRF to reach privileged internal services and elevate to higher privileges within the appliance. No public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and the flaw is not listed in CISA KEV, but a vendor patch is available.
Technical ContextAI
The root cause is CWE-918 (Server-Side Request Forgery): an application feature that fetches or forwards network requests fails to validate the destination, allowing an authenticated user to redirect those server-initiated requests to internal endpoints not normally reachable. UniFi OS is Ubiquiti's unified management operating system that runs the network controller, protect/NVR, and gateway services as co-located internal services on the same host, so an SSRF that pivots to loopback or internal management APIs can reach privileged control-plane functionality. The affected CPE set (cpe:2.3:a:ubiquiti_inc:unifi_os_server, dream_machines, dream_routers, cloud_gateways, cloud_keys, enterprise_fortress_gateway, dream_wall, express_7, network_video_recorders, enterprise_video_recorders) indicates the defect lives in the shared UniFi OS platform layer rather than a single hardware model.
RemediationAI
Vendor-released patch: UniFi OS 5.1.19. Upgrade all affected UniFi OS devices and any UniFi OS Server installations to 5.1.19 or later, as documented in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc). Because exploitation requires a low-privileged authenticated account, interim compensating controls where immediate patching is not possible include: restricting and auditing UniFi OS local/portal accounts to remove unnecessary low-privilege users (trade-off: may disrupt delegated administration), and limiting network reachability of the management interface to trusted administrative subnets or VPN rather than exposing it broadly (trade-off: remote/mobile admins lose direct access). Avoid exposing the controller UI/API to the internet. These controls reduce who can reach the SSRF entry point but do not remove the flaw, so treat them as temporary until 5.1.19 is deployed.
More in Unifi Os Server
View allUnauthenticated command injection in Ubiquiti UniFi OS devices allows remote attackers with network access to execute ar
Path traversal in Ubiquiti UniFi OS devices allows network-adjacent attackers to read sensitive files from the underlyin
Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configur
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
Command injection in Ubiquiti UniFi OS Server allows an attacker holding high-privilege access and network reachability
Command injection in Ubiquiti UniFi OS Server allows an attacker holding high-privilege (administrative) access on the n
Command injection in Ubiquiti UniFi OS devices allows a high-privileged attacker on the network to execute arbitrary ope
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today