EUVD-2026-36384
GHSA-m7hq-4j28-748g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Management plane is network-reachable (AV:N), exploitation is reliable once authenticated (AC:L), a low-privileged UniFi account is required (PR:L), no user interaction, and command execution on UniFi OS pivots to subordinate services (S:C) with full CIA impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to execute a Command Injection within such UniFi OS devices or instances.
Articles & Coverage 2
AnalysisAI
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitrary OS commands on UniFi gateways, controllers, NVRs, and NAS devices, with a CVSS 9.9 score reflecting scope change and full CIA impact. The vulnerability affects a broad device family including UDM, UDM Pro/SE/Max/Beast, UDR, UDW, UCG, UNVR, and UNAS lines per Ubiquiti Security Advisory Bulletin 065. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must have network reachability to the UniFi OS management plane (UI/API on the affected console, server, NVR, NAS, Cloud Key, or Cloud Gateway) and must hold valid low-privileged credentials on that UniFi instance (PR:L) - exploitation is not possible fully unauthenticated from the internet against a default-locked-down deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are largely aligned toward high priority: CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with scope change and total impact on the device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or been granted a low-privileged UniFi operator account (for example a site viewer, guest WiFi manager, or contractor login) reaches the UniFi OS management interface on the LAN, VPN, or an exposed remote-access endpoint and submits a crafted parameter to an API or settings field that is passed unsanitized into a shell invocation. Shell metacharacters in the payload break out of the intended command, executing arbitrary code as the management service account on the UniFi OS device and, due to scope change, pivoting to control subordinate services such as routing, firewall rules, or NVR storage. |
| Remediation | Patch available per vendor advisory: update each affected UniFi OS console, server, NVR, NAS, and Cloud Gateway/Cloud Key device to the fixed UniFi OS firmware listed in Ubiquiti Security Advisory Bulletin 065 at https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a; exact patched version numbers should be taken from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all affected devices per Ubiquiti Security Advisory 065 (UDM, UDM Pro/SE/Max/Beast, UDR, UDW, UCG, UNVR, UNAS), disable remote administrative access from untrusted network segments, implement network segmentation isolating devices to a dedicated admin VLAN. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive
Share
External POC / Exploit Code
Leaving vuln.today