EUVD-2026-66378
GHSA-f69w-w427-6rh7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable app with low-privilege account (PR:L), no UI, and command injection escaping the app to the host justifies scope change (S:C) with full C/I/A loss.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.
Articles & Coverage 1
AnalysisAI
Command injection in Ubiquiti's UniFi Protect Application lets a low-privileged, network-adjacent user run arbitrary operating-system commands on the host device (typically a UniFi NVR, Cloud Key, or Dream Machine running the Protect service). The CVSS 3.1 score of 9.9 reflects a scope change: an attacker who already holds a low-privilege application account escapes the application boundary to gain full control of the underlying host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the UniFi Protect Application interface plus a valid low-privilege Protect account (CVSS PR:L) - it is not an unauthenticated attack; no user interaction is needed (UI:N) and attack complexity is low (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point to a genuinely high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a low-privilege UniFi Protect account (for example a limited camera-viewer login, reused credentials, or an insider) sends a crafted request containing shell metacharacters to a Protect application input that is passed into a host command. The malformed input is executed on the underlying UniFi OS host, giving the attacker code execution outside the application sandbox and full control of the NVR, including stored footage and network management. … |
| Remediation | Patch available per vendor advisory: upgrade UniFi Protect to the fixed release identified in Ubiquiti Security Advisory Bulletin 067 (https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9); the exact fixed version is not included in the provided data, so verify it against that advisory before updating, and enable automatic updates on the appliance where feasible. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and document all UniFi Protect deployments, note current software versions, restrict network access to Protect management interfaces to authorized administrators only, and implement network isolation for affected devices. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Unifi Protect Application
View allCommand injection in Ubiquiti UniFi Protect Application lets a network-positioned, unauthenticated attacker run arbitrar
Privilege escalation via Server-Side Request Forgery in Ubiquiti's UniFi Protect Application allows a low-privileged, ne
Command injection in Ubiquiti's UniFi Protect Application lets a network-adjacent attacker holding only low-privileged c
Authentication bypass in Ubiquiti's UniFi Protect Application (versions before 7.1.83) allows a network-adjacent attacke
Privilege escalation in Ubiquiti's UniFi Protect Application is possible through an authenticated SQL injection (CWE-89)
Authentication bypass in Ubiquiti UniFi Protect Application lets a network-adjacent attacker reach certain API endpoints
Authentication bypass in Ubiquiti UniFi Protect Application (versions prior to 7.1.83) allows a network-adjacent attacke
Same weakness CWE-20 – Improper Input Validation
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today