EUVD-2026-41381
GHSA-x73q-38h3-xg4c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated network path traversal (PR:N/AC:L) bypassing auth on the OS to expose managed-device resources justifies S:C and C:H, with no stated integrity or availability impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances.
AnalysisAI
Authentication bypass in Ubiquiti UniFi OS devices allows a network-adjacent attacker to abuse a path traversal flaw (CWE-22) to reach protected functionality without valid credentials, affecting a broad hardware line including Dream Machines/Routers/Wall, Cloud Gateways/Keys, Express 7, Enterprise Fortress Gateway, and the UniFi OS Server software. The CVSS 8.6 rating is driven by an unauthenticated, low-complexity network vector combined with a scope change (S:C), meaning the compromised authentication boundary exposes managed device data. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of affected consoles makes this a high-priority patch.
Technical ContextAI
UniFi OS is Ubiquiti's embedded management operating system that runs the web/API control plane for consoles such as UniFi Dream Machine, Cloud Gateways, Cloud Keys, and the self-hosted UniFi OS Server, as well as NVR/EVR video appliances. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where user-controllable path input is not properly canonicalized or confined, letting a request traverse outside the intended directory. In this case the traversal is leveraged specifically to reach resources or endpoints that should sit behind authentication, effectively bypassing the login/session gate rather than merely reading arbitrary files. The CPE set (cpe:2.3:a:ubiquiti_inc:unifi_os_server, dream_machines, dream_routers, dream_wall, cloud_gateways, cloud_keys, express_7, enterprise_fortress_gateway, network_video_recorders, enterprise_video_recorders) confirms the flaw is in the shared UniFi OS platform layer rather than a single model.
RemediationAI
Patch available per vendor advisory: update every affected UniFi OS console and the UniFi OS Server to the fixed firmware/software build listed in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); exact fixed version numbers are not included in the provided data and should be taken from that advisory. Because the affected consoles typically support automatic updates, verify auto-update is enabled or apply the update manually and confirm the running build post-upgrade. As a compensating control until patched, remove the UniFi OS management/web interface from internet exposure and restrict it to a dedicated management VLAN or VPN, and disable or lock down remote access features (e.g., remote/WAN management and any port-forwards to the console) - the trade-off is loss of convenient off-site management via the web UI or mobile app. Since the description states a network-positioned attacker, network segmentation of the management plane is the most effective interim mitigation.
More in Network Attached Storage
View allAuthentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances runni
Command injection in Ubiquiti UniFi OS (all builds before 5.1.19) lets a low-privileged user on the same network run arb
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged, network-adjacent user to chain a series of authentica
Privilege escalation via Server-Side Request Forgery affects Ubiquiti UniFi OS devices and the UniFi OS Server across th
Cross-site session abuse in Ubiquiti UniFi OS lets a remote attacker who lures an authenticated operator to a malicious
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today