EUVD-2026-41382
GHSA-5wch-8p23-hj3x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain network access to Protect application
-
DeliveryTrigger improper-initialization auth state
-
ExploitBypass authentication check
-
ExecutionAccess UniFi Protect cameras
-
ImpactView/alter feeds and configuration
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Proper initialization
|
| Exploitation Conditions | Exploitation requires network access to the UniFi Protect Application (AV:N) and no prior authentication (PR:N), but is gated by 'certain conditions' cited in the advisory and reflected in the CVSS high attack complexity (AC:H) - the improper-initialization state must be present or triggered, which is not guaranteed on every request, so exploitation is not reliably repeatable against a steady-state deployment. Limiting factors that reduce real-world risk: the affected component must be network-reachable by the attacker (segmentation or lack of internet exposure blocks it), only versions below 7.1.83 are vulnerable, and CISA's SSVC rates the attack as not automatable, indicating a bespoke rather than push-button attack. No user interaction is required (UI:N). |
| Impact | Signals here are moderately conflicting and point to elevated-but-not-emergency priority. CVSS 3.1 rates it 8.1 (High) driven by network vector, no privileges (PR:N) and total C/I/A impact, but AC:H tempers this - the description's phrase 'under certain conditions' confirms exploitation is not trivially reliable. Corroborating this, EPSS is only 0.24% (15th percentile) and CISA's SSVC framework marks Exploitation: none and Automatable: no, while still rating Technical Impact: total. The absence of KEV listing and no public POC means this is not under active exploitation. Net: a genuinely high-impact authentication bypass worth prompt patching, but the high complexity and non-automatable nature make mass exploitation unlikely - prioritize based on camera exposure and network segmentation rather than treating it as an actively-weaponized threat. |
| Exploit ScenarioDerived | An attacker positioned on the same network as a UniFi Protect deployment sends specially sequenced requests that hit the application while its authentication state is improperly initialized, slipping past the login check to reach the cameras. Having bypassed authentication, the attacker views live and recorded video, alters camera configuration, or disrupts the surveillance feed. No public exploit code is currently known, and the high attack complexity means the attacker likely needs to win a specific timing or state condition. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 07, 2026
Authentication bypass in Ubiquiti UniFi Protect Application (versions prior to 7.1.83) allows a network-adjacent attacker to circumvent authentication controls on UniFi Protect Cameras via an improper initialization flaw. The bypass yields total compromise of camera confidentiality, integrity, and availability, though exploitation depends on certain unspecified conditions and carries high attack complexity. No public exploit is identified at time of analysis, and EPSS probability is low (0.24%), consistent with the CISA SSVC assessment of no known exploitation.
Earlier versions of this analysis (2)
Authentication bypass in Ubiquiti's UniFi Protect Application (all versions before 7.1.83) lets a network-adjacent, unauthenticated attacker circumvent camera authentication under certain conditions, stemming from an improper initialization flaw (CWE-665). Successful exploitation yields full compromise of the affected UniFi Protect Cameras (high confidentiality, integrity, and availability impact). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the low EPSS score (0.24%) and high CVSS attack complexity indicate exploitation is non-trivial rather than trivially weaponizable.
Authentication bypass in Ubiquiti's UniFi Protect Application lets a network-adjacent attacker gain unauthorized access to managed UniFi Protect Cameras by abusing an improper initialization flaw (CWE-665). The issue is remotely reachable but constrained - successful exploitation requires specific conditions and some user interaction - and no public exploit code has been identified at time of analysis. Ubiquiti has published Security Advisory Bulletin 066 addressing the flaw.
RemediationAI
Vendor-released patch: upgrade the UniFi Protect Application to version 7.1.83 or later, which is the primary and definitive fix per Ubiquiti Security Advisory Bulletin 066-066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc). Until the update is applied, reduce exposure by restricting network access to the UniFi Protect Application and its cameras to trusted management VLANs and removing any direct internet or untrusted-LAN reachability, since the attack requires network access - the trade-off is that legitimate remote or cross-segment viewing must instead route through a hardened VPN or the vendor's cloud path. Avoid exposing the Protect controller/console ports to broad network zones, accepting that tighter segmentation may complicate ad-hoc access for operators.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the UniFi Protect Application, Ubiquiti's video surveillance management platform that pairs with UniFi Protect network cameras (CPE cpe:2.3:a:ubiquiti_inc:unifi_protect_application). The root cause is classified as CWE-665 (Improper Initialization), meaning a variable, session, credential, or security state is not correctly established before use - in this case leaving an authentication check in a state that can be bypassed. Because the flaw sits in the application layer that mediates access to cameras, a successful bypass grants an attacker the same trust the application would normally require credentials to obtain.
Know when Unifi Protect Application gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N) but gated by 'certain conditions' so AC:H; authentication bypass grants full camera control, giving total C/I/A impact.
Primary rating from Vendor (hackerone).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UniFi Protect Application to bypass authentication in UniFi Protect Cameras.
Executive ViewAI
Ubiquiti UniFi Protect Application (versions prior to 7.1.83) contains an authentication bypass vulnerability (CVSS 8.1) that allows unauthenticated network-adjacent attackers to achieve complete compromise of camera confidentiality, integrity, and availability. No public exploit identified at time of analysis. This vulnerability directly undermines physical security infrastructure and requires immediate patching for any organization relying on UniFi Protect for surveillance operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Unifi Protect Application
View allCommand injection in Ubiquiti UniFi Protect Application lets a network-positioned, unauthenticated attacker run arbitrar
Command injection in Ubiquiti's UniFi Protect Application lets a low-privileged, network-adjacent user run arbitrary ope
Command injection in Ubiquiti's UniFi Protect Application lets a network-adjacent attacker holding only low-privileged c
Privilege escalation via Server-Side Request Forgery in Ubiquiti's UniFi Protect Application allows a low-privileged, ne
Authentication bypass in Ubiquiti's UniFi Protect Application (versions before 7.1.83) allows a network-adjacent attacke
Privilege escalation in Ubiquiti's UniFi Protect Application is possible through an authenticated SQL injection (CWE-89)
Authentication bypass in Ubiquiti UniFi Protect Application lets a network-adjacent attacker reach certain API endpoints
Exploit-DB