EUVD-2026-66398
GHSA-g4h7-m732-3278
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Remote unauthenticated CRLF auth bypass (AV:N/PR:N), but 'certain conditions' justify AC:H; full appliance compromise across a security boundary gives S:C and C/I/A:H.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.
AnalysisAI
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by injecting CRLF sequences, granting full control over the appliance under certain conditions. It affects a broad range of UniFi OS platforms including Cloud Gateways, Dream Machines/Routers, Cloud Keys, and Enterprise NVR/NAS hardware. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to an affected UniFi OS device's authentication interface (AV:N, PR:N - no credentials needed) and the ability to inject CRLF sequences into the auth flow. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed but lean toward real priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to the same network as a UniFi gateway or Cloud Key sends specially crafted requests containing embedded CRLF sequences to the UniFi OS authentication endpoint, splitting or forging the request/response to make the system accept the session as authenticated. Having bypassed login, the attacker gains administrative control of the appliance and the network it manages. … |
| Remediation | Apply the UniFi OS updates published in Ubiquiti Security Advisory Bulletin 067 (https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9); a patch is available per the vendor advisory, though no single fixed version string is included in this dataset, so consult the bulletin for the exact build per device model and update each affected appliance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a comprehensive inventory of all Ubiquiti UniFi OS devices deployed across your infrastructure, identifying which platforms are running and their current locations in the network topology. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Unifi Os Server
View allUnauthenticated command injection in Ubiquiti UniFi OS devices allows remote attackers with network access to execute ar
Path traversal in Ubiquiti UniFi OS devices allows network-adjacent attackers to read sensitive files from the underlyin
Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configur
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to
Command injection in Ubiquiti UniFi OS devices allows a high-privileged attacker on the network to execute arbitrary ope
Command injection in Ubiquiti UniFi OS Server allows an attacker holding high-privilege access and network reachability
Command injection in Ubiquiti UniFi OS Server allows an attacker holding high-privilege (administrative) access on the n
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances runni
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today