EUVD-2026-41391
GHSA-ghgx-h467-6r25
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable management interface (AV:N) with low complexity and no user interaction, but requires a low-privilege authenticated account (PR:L); command execution on the host yields total C/I/A impact.
Primary rating from Vendor (hackerone).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.
Articles & Coverage 1
AnalysisAI
Command injection in Ubiquiti UniFi OS (all builds before 5.1.19) lets a low-privileged user on the same network run arbitrary operating-system commands on the underlying host device, giving full control of gateways, recorders, and Cloud Keys. The flaw stems from improper input validation (CWE-20) and carries high confidentiality, integrity, and availability impact (CVSS 8.8). There is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as none, but the technical impact is total and a vendor patch is already available.
Technical ContextAI
UniFi OS is the embedded Linux-based management operating system that runs Ubiquiti's networking and video product lines - Dream Machine/Router/Wall gateways, Cloud Gateways, Cloud Keys, Express 7, Enterprise Fortress Gateway, Enterprise Firewall Core, and Network/Enterprise Video Recorders, plus the self-hosted UniFi OS Server (per the ubiquiti_inc CPE entries). The root cause is CWE-20 Improper Input Validation: attacker-controlled input reaches a host command context without adequate sanitization, allowing shell metacharacters or arguments to be injected and executed by the OS. Because the injection runs on the host device itself, successful exploitation translates directly into control of the appliance's operating system rather than just the management application.
RemediationAI
Vendor-released patch: UniFi OS 5.1.19. Upgrade every affected device - Dream Machine/Router/Wall, Cloud Gateways, Cloud Keys, Express 7, Enterprise Fortress Gateway, Enterprise Firewall Core, UniFi OS Server, and the NVR/EVR/NAS lines - to 5.1.19 or later as described in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc). Because exploitation requires a low-privileged authenticated user with network access, effective interim compensating controls until patching is complete are: restrict the UniFi OS management interface to a dedicated management VLAN and trusted admin IPs (side effect: admins must connect from that segment), ensure the management UI and SSH are never exposed to the internet, and audit and reduce the number of low-privilege local accounts and revoke unnecessary ones (side effect: some delegated operators lose access). Enforcing strong, unique credentials and MFA on management accounts further limits who can reach the vulnerable authenticated surface.
More in Unifi Os Server
View allUnauthenticated command injection in Ubiquiti UniFi OS devices allows remote attackers with network access to execute ar
Path traversal in Ubiquiti UniFi OS devices allows network-adjacent attackers to read sensitive files from the underlyin
Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configur
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
Command injection in Ubiquiti UniFi OS Server allows an attacker holding high-privilege access and network reachability
Command injection in Ubiquiti UniFi OS Server allows an attacker holding high-privilege (administrative) access on the n
Command injection in Ubiquiti UniFi OS devices allows a high-privileged attacker on the network to execute arbitrary ope
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Same weakness CWE-20 – Improper Input Validation
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today