EUVD-2026-84754
GHSA-gx3q-h4jp-wj72
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vulnerable service on gateway
-
DeliverySend crafted network request
-
ExploitTrigger out-of-bounds write (CWE-787)
-
ExecutionCorrupt device memory
-
ImpactCrash service and deny availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the vulnerable service on an affected Ubiquiti UniFi gateway (Dream Machine, Dream Router, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, or UniFi Gateways). No authentication and no user interaction are required (PR:N/UI:N), and complexity is low (AC:L). Limiting factors: the attacker must be able to route packets to the specific vulnerable service - impact is bounded by network exposure (WAN-facing vs. LAN-only management interface); the description does not name the exact protocol/port, and impact is confined to denial of service (device/service crash) with no confidentiality or integrity loss. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) describes a network-reachable, unauthenticated, low-complexity flaw with availability-only impact - no confidentiality or integrity loss. That is internally consistent with the description (network actor triggers a DoS). No EPSS score, KEV listing, POC, or SSVC decision data is provided in the input, so exploitation likelihood cannot be quantified: no public exploit identified at time of analysis. The single-source, vendor-self-reported nature (Ubiquiti Bulletin-069) and absence of any exploitation evidence make this a moderate-priority patching item rather than an emergency. Worth noting: the underlying CWE-787 out-of-bounds WRITE is a memory-corruption primitive that could in principle enable code execution, yet the vendor explicitly scopes impact to DoS only (C:N/I:N). This gap (write primitive but availability-only impact claimed) is either a genuinely constrained bug or a conservative/incomplete vendor assessment - verify against the advisory before fully discounting integrity risk. Real risk hinges on whether the vulnerable service is exposed to untrusted networks (WAN/guest) versus only LAN. |
| Exploit ScenarioDerived | An attacker with network reachability to the affected UniFi gateway's vulnerable service sends crafted traffic that triggers an out-of-bounds write in the device firmware, corrupting memory and crashing the process or device. No authentication or user interaction is required (PR:N/UI:N), so repeated requests can keep the gateway offline, disrupting connectivity for the network behind it. No public proof-of-concept is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Network-reachable out-of-bounds write in Ubiquiti UniFi gateway devices-including Dream Machine, Dream Router, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways-allows unauthenticated remote attackers to crash the device, causing a denial of service. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning availability-only impact with no confidentiality or integrity loss. No public exploit identified at time of analysis; Ubiquiti Security Advisory Bulletin 069 provides remediation guidance.
RemediationAI
Apply the latest firmware update for the affected UniFi gateway devices as directed by Ubiquiti Security Advisory Bulletin 069 (https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c). No exact fix version is provided in the input data, so consult the advisory to identify the corrected firmware build. Until patching is possible, restrict network reachability to the gateway's management and service interfaces to trusted internal networks only, and block unnecessary inbound traffic from untrusted networks. Note that tightly restricting management access may impede legitimate remote administration. Monitor logs for unexplained device crashes or restarts, which could indicate attempted exploitation. No vendor-released patch version is identified in the available data; the advisory is the authoritative source for remediation steps.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 8 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as an out-of-bounds write (CWE-787) in the firmware of multiple Ubiquiti UniFi gateway products, specifically those identified by CPE strings for dream_machines, dream_routers, dream_wall, cloud_gateways, enterprise_firewalls, express, express_7, and unifi_gateways. CWE-787 occurs when software writes data beyond the bounds of an allocated memory buffer, corrupting adjacent memory structures. In this case, a remote attacker who can send network traffic to a vulnerable service on the gateway can trigger the memory corruption, likely through a malformed packet, leading to a crash or service interruption. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication or user interaction is required and attack complexity is low, but the exact protocol and port are not specified in the available data. Impact is confined to denial of service; there is no loss of confidentiality or integrity.
Know when Express gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network-reachable low-complexity out-of-bounds write; vendor scopes impact to denial of service only, so C:N/I:N/A:H and S:U.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
Articles & Coverage 2
Executive ViewAI
Ubiquiti UniFi gateway devices - including the Dream Machine, Dream Router, Cloud Gateways, Enterprise Firewalls, Express/Express 7 and UniFi Gateways - can be remotely crashed by an unauthenticated attacker, cutting off network connectivity and internet access for every site, branch, or retail location that depends on them. Because no vendor patch has been released and the affected devices sit at the network edge, leadership should treat this as a broad, persistent availability risk across the estate rather than an isolated hardware issue. A sustained or repeated attack could interrupt business operations, customer-facing services, and remote access until devices are manually recovered.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict inbound access to UniFi gateway management interfaces to allow-listed administrative networks, place management on a dedicated VLAN rather than exposing it to the WAN, disable remote administration that is not strictly required, apply upstream firewall filtering and rate-limiting to drop anomalous traffic before it reaches the device, deploy IDS/IPS signatures for malformed traffic directed at gateway services, monitor for unexpected reboots or crash loops as an indicator of attempted exploitation, and maintain standby or secondary connectivity so a device crash does not cause a full site outage.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Denial of Service vulnerability in Multer (Node.js multipart form-data middleware) affecting versions 1.4.4-lts.1 throug
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive
Unauthenticated network attackers can crash Ubiquiti UniFi gateway devices by sending crafted traffic that triggers an o
Denial of service in Ubiquiti UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterpri
Unauthenticated network attackers who can reach an affected Ubiquiti UniFi gateway can trigger an out-of-bounds read (CW
Denial of service in UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewa
Exploit-DB