UniFi OS CVE-2026-54402

Exploitation requires (1) network reachability to the affected UniFi OS device's management surface and (2) a valid low-privilege authenticated account on that device - the CVSS vector's PR:L confirms authentication is needed, and the description explicitly states 'low privileges.' No user interaction and no special non-default feature toggle is documented as required (UI:N), so any UniFi OS build before 5.1.19 with a reachable management interface is exploitable by an authenticated low-privilege actor. The practical limiters are the need for that authenticated foothold and network access to the management interface, which in default deployments is LAN/management-network scoped rather than internet-facing; there is no unauthenticated path.

The signals are moderately consistent but not alarming. CVSS 3.1 is 8.8 (High) with network vector, low complexity, and only low privileges required (AV:N/AC:L/PR:L/UI:N), and SSVC rates technical impact as 'total' - meaning a successful exploit fully compromises the device. Countervailing signals lower the urgency: EPSS is only 0.79% (52nd percentile), SSVC exploitation status is 'none' (not in CISA KEV), and SSVC marks it not automatable. No public exploit has been identified. The key limiter is PR:L - the attacker must already hold a low-privilege authenticated foothold and network reachability to the management interface, which is not typically internet-exposed by default. Net assessment: a genuinely serious device-takeover bug worth prompt patching in managed fleets, but current real-world exploitation risk is low-to-moderate rather than emergency, and it is better treated as targeted-risk than mass-exploitable. No data conflicts were observed between the CVSS vector and the description; both indicate authenticated network-adjacent access.

An attacker who has obtained a low-privileged UniFi account - for example a limited operator login or reused/leaked credentials - and can reach the device's management interface over the network submits a crafted value into a vulnerable input field that is passed to a host command. The injected shell payload executes on the UniFi OS host, giving the attacker command execution as the appliance's service context and a path to full device takeover. No public proof-of-concept has been identified, and the attack requires the authenticated foothold rather than being anonymously exploitable.