EUVD-2026-41400
GHSA-hh99-693c-cjm3
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 09, 2026
Unauthorized configuration changes on Ubiquiti UniFi OS gateway devices (Dream Machines, Dream Routers, Cloud Gateways, Enterprise Firewall Core, Enterprise Fortress Gateway, Dream Wall and Express 7) are possible through an improper access control flaw that, under certain network configurations, lets a network-adjacent attacker alter device settings without proper authorization. Ubiquiti has released version 5.1.19 to fix the issue via Security Advisory Bulletin 066. There is no public exploit identified at time of analysis, EPSS probability is low (0.22%), and CISA SSVC records exploitation status as none, but the total technical impact and 9.8 CVSS rating make this a high-priority patch for exposed gateways.
Earlier versions of this analysis (2)
Unauthorized configuration changes are possible in Ubiquiti UniFi OS gateway devices (Dream Machines, Dream Routers, Cloud Gateways, Enterprise Fortress Gateway, Enterprise Firewall Core, Dream Wall, Express 7) before version 5.1.19, where an Improper Access Control flaw lets a network-adjacent attacker alter device settings under certain network configurations. The vendor has released a patched firmware (5.1.19) and CVSS rates it 9.8 critical, though EPSS is low (0.22%) and there is no public exploit identified at time of analysis. SSVC scores exploitation as none but technical impact as total, indicating high potential damage if reached.
Improper access control in Ubiquiti UniFi OS gateway devices allows a network-adjacent attacker to make unauthorized changes to affected devices under certain network configurations, effectively bypassing authentication (tagged as an Authentication Bypass). Affected hardware includes Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Express 7, Enterprise Fortress Gateway, and Enterprise Firewall Core. Rated CVSS 9.0 (critical) with no authentication required (PR:N) but high attack complexity (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 7 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Express 7 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network vector unauthenticated, but 'certain network configurations' requirement raises attack complexity to AC:H; improper access control yields total control over device (C/I/A High).
Primary rating from Vendor (hackerone).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.
Executive ViewAI
Ubiquiti UniFi gateway devices widely deployed in enterprise networks are vulnerable to unauthorized configuration changes by local network attackers, risking compromise of network access controls and security visibility. Such misconfigurations could enable policy bypass, traffic interception, or disabling of security enforcement. Vendor patch version 5.1.19 is available and should be deployed immediately.
Within 24 hours: Identify all Ubiquiti UniFi gateway devices in production environments. Within 7 days: Validate patch version 5.1.19 in non-production environments and begin staged rollout to production. Within 30 days: Complete deployment of version 5.1.19 across all affected gateway devices.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated command injection in Ubiquiti UniFi OS devices allows remote attackers with network access to execute ar
Path traversal in Ubiquiti UniFi OS devices allows network-adjacent attackers to read sensitive files from the underlyin
Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configur
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances runni
Command injection in Ubiquiti UniFi OS (all builds before 5.1.19) lets a low-privileged user on the same network run arb
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged, network-adjacent user to chain a series of authentica
Exploit-DB