EUVD-2026-66403Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network-reachable command injection with low complexity; command execution on the host escapes the app boundary (S:C) causing full C/I/A loss.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device.
AnalysisAI
Remote command injection in Ubiquiti's UniFi Talk Application lets a network-positioned attacker run arbitrary commands on the underlying host device due to improper input validation (CWE-20). Ubiquiti rates it CVSS 10.0 with a changed scope, meaning a successful attack escapes the application boundary to fully compromise the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the UniFi Talk Application service on the host device; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed against a reachable instance, so any attacker able to route packets to the Talk service can attempt it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue rather than an inflated high-CVSS score: the vendor-supplied vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) describes an unauthenticated, low-complexity, network-reachable command injection with scope change and total confidentiality/integrity/availability loss - the maximal 10.0 rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the UniFi Talk service on the network sends a crafted request containing shell metacharacters in an insufficiently validated input field, which the host executes as an OS command, granting arbitrary code execution on the console. Because scope is changed (S:C), the attacker pivots from the Talk application to full control of the underlying host device. … |
| Remediation | Apply the fixed UniFi Talk Application release referenced in Ubiquiti Security Advisory Bulletin 067 (https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9); the provided data indicates a patch is available per vendor advisory but does not state the exact fixed version number, so obtain and pin the specific patched build from that advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Ubiquiti UniFi Talk Application deployments and assess network exposure; immediately implement network segmentation to restrict access to UniFi Talk systems to only trusted administrative networks and necessary users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Unifi Talk Application
View allPrivilege escalation in Ubiquiti's UniFi Talk Application allows an authenticated attacker holding a low-privileged acco
Privilege escalation in Ubiquiti's UniFi Talk Application allows a low-privileged, network-adjacent user to gain elevate
Server-Side Request Forgery in Ubiquiti's UniFi Talk Application allows a network-positioned attacker to coerce the appl
Same weakness CWE-20 – Improper Input Validation
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today