Skip to main content
View

Vulnerability Assessment

Weakness
CWE
CWE-284
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK

1 technique across 1 tactic: Defense Evasion

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 10, 2026

Privilege escalation in UniFi OS running the UniFi Protect Application (versions below 5.1.19) allows a network-adjacent, low-privileged attacker to gain control of the underlying host device via improper access control. Affected hardware spans Ubiquiti's Dream Machines, Dream Wall, Dream Routers, Cloud Keys, Cloud Gateways, and Network/Enterprise Video Recorders. No public exploit identified at time of analysis; EPSS is low (0.19%) and CISA SSVC records no known exploitation, but the total technical impact and 8.8 CVSS make it a meaningful patch priority.

Earlier versions of this analysis (2)
v2 Jul 10, 2026 - 02:58 cvss changed CVSS 8.8

Privilege escalation in Ubiquiti UniFi OS running the UniFi Protect Application allows a network-adjacent, low-privileged user to gain elevated privileges on the underlying host device across the Dream Machine, Dream Wall, Dream Router, Cloud Key, Cloud Gateway, and Network/Enterprise Video Recorder product lines (fixed in 5.1.19). The flaw is an improper access control (CWE-284) issue reported via HackerOne and carries a CVSS 8.8 with total technical impact, though SSVC records no known exploitation and EPSS is low (0.19%). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

v1 Jul 02, 2026 - 15:37 CVSS 7.5

Privilege escalation in Ubiquiti's UniFi OS running the UniFi Protect Application allows a network-adjacent attacker holding low-privilege credentials to gain elevated privileges on the underlying host device through an improper access control (authentication bypass) flaw. The issue spans Ubiquiti's UniFi console hardware line - Dream Machines, Dream Wall, Dream Routers, Cloud Keys, Network/Enterprise Video Recorders, and Cloud Gateways - running Protect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the high-privilege-gain impact on widely deployed consumer and enterprise gear makes patching worthwhile.

Affected VersionsENISA

Dream Wall 0 <5.1.19
Dream Routers 0 <5.1.19
Cloud Keys 0 <5.1.19
Network Video Recorders 0 <5.1.19
Dream Machines 0 <5.1.19
Cloud Gateways 0 <5.1.19
Enterprise Video Recorders 0 <5.1.19

Affected Packages

euvd cloud_gateways fix: 5.1.19
euvd cloud_keys fix: 5.1.19
euvd dream_machines fix: 5.1.19
euvd dream_routers fix: 5.1.19
euvd dream_wall fix: 5.1.19
euvd enterprise_video_recorders fix: 5.1.19
euvd network_video_recorders fix: 5.1.19

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 7 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Dream Machines gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (hackerone) PRIMARY HIGH
NVD 8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.5 HIGH

Reachable over the network with a low-privileged account (AV:N/PR:L); the vendor's 'certain conditions' caveat justifies AC:H, and host takeover gives total C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Updated
Jul 10, 2026 - 02:59 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 10, 2026 - 02:58 vuln.today
v2 - CVSS changed
CVSS changed
Jul 10, 2026 - 02:52 NVD
7.5 (HIGH) 8.8 (HIGH)
Patch available
Jul 02, 2026 - 16:17 EUVD

DescriptionNVD

A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi OS with UniFi Protect Application to escalate privileges on the host device.

Executive ViewAI

Why It Matters

UniFi Protect Application deployed across Ubiquiti network infrastructure (Dream Machines, Dream Walls, Dream Routers, Cloud Keys, Cloud Gateways, and Enterprise Video Recorders) contains a privilege escalation flaw enabling attackers with network access to gain complete host device control. No public exploit identified at time of analysis and exploitation probability is low (0.2% EPSS), but the high technical impact justifies timely remediation. These systems' critical roles in network connectivity and security monitoring mean any successful attack could undermine both operational and physical security infrastructure.

Recommended Action

Within 24 hours: Inventory all Ubiquiti UniFi systems in production and document current UniFi Protect Application versions. Within 7 days: Develop patching plan prioritizing internet-facing systems and those with direct security monitoring responsibilities. Within 30 days: Deploy UniFi Protect Application version 5.1.19 or later to all affected systems and validate successful patching across the infrastructure.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 91% exploitable
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Dream Machines

View all
CVE-2026-77550 CRITICAL
10.0 Aug 26

Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
CVE-2026-77536 CRITICAL
9.9 Aug 26

Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate

CVE-2026-77534 CRITICAL
9.9 Aug 26

Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to
CVE-2026-55116 CRITICAL
9.8 Jul 02

Unauthorized configuration changes on Ubiquiti UniFi OS gateway devices (Dream Machines, Dream Routers, Cloud Gateways,

CVE-2026-77549 CRITICAL
9.0 Aug 26

Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
CVE-2026-77545 CRITICAL
9.0 Aug 26

Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances runni
CVE-2026-54402 HIGH
8.8 Jul 02

Command injection in Ubiquiti UniFi OS (all builds before 5.1.19) lets a low-privileged user on the same network run arb
CVE-2026-54404 HIGH
8.8 Jul 02

Privilege escalation in Ubiquiti UniFi OS allows a low-privileged, network-adjacent user to chain a series of authentica
CVE-2026-54401 HIGH
8.8 Jul 02

Privilege escalation via Server-Side Request Forgery affects Ubiquiti UniFi OS devices and the UniFi OS Server across th
CVE-2026-54403 HIGH
8.6 Jul 02

Authentication bypass in Ubiquiti UniFi OS devices allows a network-adjacent attacker to abuse a path traversal flaw (CW
CVE-2026-95862 HIGH
7.5 Sep 22

Unauthenticated network attackers can crash Ubiquiti UniFi gateway devices by sending crafted traffic that triggers an o
CVE-2026-95861 HIGH
7.5 Sep 22

Denial of service in Ubiquiti UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterpri

Same weakness CWE-284 – Improper Access Control

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-55112 ADVISORY https://vuldb.com/vuln/375954 REF https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy