UniFi OS CVE-2026-54403

Exploitation requires network reachability to the UniFi OS device's management/web interface and a device running a vulnerable UniFi OS build; per the vendor, the actor needs 'access to the network' the device is on, so the practical prerequisite is a routable path to the management plane (LAN, adjacent VLAN, VPN, or internet exposure). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity, so against a reachable, unpatched console there are no additional feature or configuration prerequisites. The primary limiting factor is exposure of the management interface: consoles confined to an isolated management network are substantially harder to reach, whereas those with remote/WAN management or port-forwarding enabled are directly exploitable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) describes a genuinely low-barrier attack: remote, no authentication, no user interaction, low complexity, with a scope change and high confidentiality impact - the classic profile of a serious auth-bypass. No EPSS score, KEV entry, or POC was provided, so exploitation-likelihood signals are absent rather than negative; the vulnerability was reported responsibly via HackerOne, which typically precedes public exploit code. There is a minor tension to verify: the vendor description says 'a malicious actor with access to the network,' implying network-adjacent positioning (e.g., LAN or reachable management interface), whereas AV:N models fully remote reachability - defenders whose UniFi management plane is exposed to the internet or a large shared network should treat this as internet-facing, while those who restrict management to an isolated VLAN materially reduce exposure. Overall this is a real priority driven by product prevalence and unauthenticated access, even though wide-scale exploitation is not yet evidenced.

An attacker with reachability to a UniFi OS device's management interface - for example on the same LAN, a guest/IoT segment that can route to it, or an internet-exposed console - sends a crafted request containing traversal sequences to a path-handling endpoint. The malformed path resolves to a protected resource, letting the attacker bypass authentication and access controller data or functionality without any credentials or user interaction. No public POC is currently identified, but the low attack complexity means one could be developed quickly once details circulate.