EUVD-2026-84756
GHSA-pvxj-q65p-2m5r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed UniFi gateway service over network
-
DeliverySend crafted malformed packet/request
-
ExploitTrigger out-of-bounds read in parser
-
ExecutionCrash gateway process
-
ImpactDenial of service / connectivity loss
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to a vulnerable service on the UniFi gateway (Dream Machine, Dream Router, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express/Express 7, or generic UniFi Gateways). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special configuration are needed - an attacker who can send traffic to the affected device's exposed interface can trigger the out-of-bounds read. The primary limiting factor is network exposure: if the vulnerable service is bound only to a trusted LAN/management interface and not reachable from the WAN or untrusted segments, the attack surface is substantially reduced; impact is limited to availability (device crash/DoS) with no confidentiality or integrity loss. |
| Impact | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) is internally consistent: an out-of-bounds read (CWE-125) reachable by any network-adjacent, unauthenticated actor, causing an availability-only impact (crash/DoS). No EPSS score, no CISA KEV listing, and no public POC were provided, so despite the HIGH score there is no evidence of active or imminent exploitation - this reads as a real-but-not-urgent patch-in-cycle issue rather than a fire-drill. Note the impact-signal conflict: the 'Information Disclosure' tag and the description's own 'Out-of-bounds Read' framing suggest potential memory disclosure, yet the CVSS sets C:N and scores only A:H, meaning the vendor assessed this as a pure crash with no data leakage - the DoS characterization should be treated as authoritative and the info-disclosure tag as mislabeled. The single self-reported Ubiquiti advisory (Bulletin 069) is the only source; affected products are enumerated via CPE but no fixed firmware version is given in the input, which should be confirmed against the advisory. |
| Exploit ScenarioDerived | An attacker with network access to a UniFi gateway's reachable service sends a malformed packet or request that triggers an out-of-bounds read in the parsing code, causing the process or device to crash. No authentication or user interaction is required, and repeated requests can hold the gateway in a denial-of-service state, disrupting connectivity for the network behind it. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Unauthenticated network attackers who can reach an affected Ubiquiti UniFi gateway can trigger an out-of-bounds read (CWE-125) that crashes the device, producing a denial-of-service condition rated 7.5 HIGH. The issue affects the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express/Express 7, and generic UniFi Gateway product lines, and no public exploit code was identified at time of analysis. Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no credentials, user interaction, or special configuration are required - the practical constraint is network exposure, since the attack surface shrinks considerably if the vulnerable service is bound only to a trusted LAN or management interface rather than the WAN or untrusted segments.
RemediationAI
The supplied data does not include an exact fixed firmware version, so patch status cannot be pinned to a specific build from this input alone - consult Ubiquiti's Security Advisory Bulletin 069 (https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c) for the affected firmware list and the corresponding fixed releases, and upgrade every Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express/Express 7, and UniFi Gateway to that vendor-released firmware (applying upgrades during a maintenance window, since a gateway reboot will interrupt all routed traffic). Until the fixed firmware is confirmed and deployed, the highest-value compensating control is exposure reduction: ensure the gateway's management and any non-essential services are reachable only from a trusted management VLAN/LAN and are not exposed to the WAN or guest/untrusted segments, using WAN-local firewall rules and port-forward restrictions so an unauthenticated AV:N attacker cannot reach the vulnerable service at all - the trade-off being that legitimate remote management and remote VPN access will also be blocked unless routed through an authenticated VPN or a hardened bastion. Consider disabling or not publishing any optional remote-access/listener features on the gateway that are not required for operations (side effect: loss of convenience features such as remote console access), and enable logging/alerting on gateway process crashes or unexpected reboots so exploitation attempts (which manifest as availability loss) are detected, though such monitoring does not prevent the DoS itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 8 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is an out-of-bounds read (CWE-125), a memory-safety class in which code reads past the end of an allocated buffer while processing attacker-supplied input in a network-facing service on the gateway firmware. In this case the read faults or destabilizes the service/device process and results in an availability-only impact, which the vendor CVSS vector and the independent assessment both confirm (C:N/I:N/A:H). The associated tags include 'Buffer Overflow' and 'Information Disclosure', which is consistent with an out-of-bounds memory access family of bugs - an out-of-bounds read can in principle leak adjacent memory - but the assessed vector assigns no confidentiality impact, so in this instance the demonstrated and assessed consequence is a crash/DoS rather than data exfiltration. Per the CPE data, the affected codebase spans the UDM/Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express, Express 7, and generic UniFi Gateway firmware lines, all listed with version wildcards, indicating a shared firmware component affected across the gateway portfolio rather than a single SKU. The specific packet parser or service routine involved is not detailed in the vendor Security Advisory Bulletin 069, so the exact reachable endpoint depends on which services the device exposes on each interface.
Know when Express gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network-reachable trigger (AV:N/AC:L/PR:N/UI:N); out-of-bounds read yields device crash only, so C:N/I:N/A:H with no scope change.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
Articles & Coverage 2
Executive ViewAI
Ubiquiti UniFi gateways, Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express/Express 7 and generic UniFi Gateway models can be crashed remotely by an unauthenticated attacker who can reach the affected service, taking down the network path for every site behind that device. Because these appliances typically sit at the internet edge and carry both routing and firewall duties, a successful attack can interrupt business connectivity, remote access, and cloud-dependent operations at the affected location until the device is manually recovered. No public exploit code has been identified and no vendor patch has been released, so leadership exposure is currently a function of how many of these gateways are reachable from untrusted networks rather than of attacker tooling maturity.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict the vulnerable service so it is reachable only from a trusted LAN or management interface, block WAN-side and untrusted-segment access at the upstream firewall, remove unnecessary port forwarding and remote management exposure, and monitor these gateways for unexpected reboots or crashes with documented out-of-band recovery procedures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Denial of Service vulnerability in Multer (Node.js multipart form-data middleware) affecting versions 1.4.4-lts.1 throug
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive
Unauthenticated network attackers can crash Ubiquiti UniFi gateway devices by sending crafted traffic that triggers an o
Denial of service in Ubiquiti UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterpri
Denial of service in UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewa
Network-reachable out-of-bounds write in Ubiquiti UniFi gateway devices-including Dream Machine, Dream Router, Dream Wal
Exploit-DB