UniFi OS EUVD-2026-31387

The attacker must have network reachability to the UniFi OS management interface (web/API) of an affected device and must hold a valid low-privileged UniFi account on that device or controller - PR:L per the CVSS vector rules out fully unauthenticated exploitation. No user interaction, no special client, and no non-default configuration is required beyond running a standard UniFi OS build on one of the listed models (UDM/UDR/UCG/UNVR/UNAS/UCK families). Limiting factors: the management plane is typically not exposed to the public internet by default, so practical reach depends on whether the device's UI is accessible from the user/guest VLAN, from a VPN, or via Ubiquiti's remote-access cloud; environments that segment the management network and limit account issuance substantially reduce real-world exposure.

Signals are mixed-but-meaningful: the CVSS vector AV:N/AC:L/PR:L/UI:N indicates remote, low-complexity exploitation requiring only low privileges and no user interaction, with C:H/I:N/A:N (high confidentiality impact, no integrity or availability impact) - classic info-disclosure. Scope:Changed pushes the base score to 7.7 because traversal crosses the security boundary of the management app into the host OS. There is no EPSS score, no KEV listing, and no public POC referenced, so this is not currently a mass-exploitation candidate; however, the very large affected device footprint (consumer and SMB gateways frequently exposed to LAN/management VLANs) and the low PR:L bar (any holder of a read-only or guest UniFi account on the network) make this a realistic stepping-stone for credential or key recovery. Treat as a credible internal-threat and post-compromise risk rather than an internet-wide emergency, but patch promptly on any device where untrusted users hold UniFi accounts.

An attacker who has obtained a low-privileged UniFi account - for example a limited site/read-only role created for a contractor, or credentials harvested from a phished employee - authenticates to the UniFi OS web/API endpoint over the LAN or VPN and issues a crafted request whose path parameter contains traversal sequences. The vulnerable handler reads the targeted file (e.g. configuration backups, SSH host keys, or persisted secrets) and returns its contents, which the attacker uses to pivot to full device administration or to reach other systems. No public exploit is identified at time of analysis, but the low complexity (AC:L) and absence of user interaction (UI:N) make a working POC straightforward to develop once the vulnerable endpoint is known.