EUVD-2026-41382
GHSA-5wch-8p23-hj3x
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N) but gated by 'certain conditions' so AC:H; authentication bypass grants full camera control, giving total C/I/A impact.
Primary rating from Vendor (hackerone).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UniFi Protect Application to bypass authentication in UniFi Protect Cameras.
AnalysisAI
Authentication bypass in Ubiquiti UniFi Protect Application (versions prior to 7.1.83) allows a network-adjacent attacker to circumvent authentication controls on UniFi Protect Cameras via an improper initialization flaw. The bypass yields total compromise of camera confidentiality, integrity, and availability, though exploitation depends on certain unspecified conditions and carries high attack complexity. No public exploit is identified at time of analysis, and EPSS probability is low (0.24%), consistent with the CISA SSVC assessment of no known exploitation.
Technical ContextAI
The vulnerability resides in the UniFi Protect Application, Ubiquiti's video surveillance management platform that pairs with UniFi Protect network cameras (CPE cpe:2.3:a:ubiquiti_inc:unifi_protect_application). The root cause is classified as CWE-665 (Improper Initialization), meaning a variable, session, credential, or security state is not correctly established before use - in this case leaving an authentication check in a state that can be bypassed. Because the flaw sits in the application layer that mediates access to cameras, a successful bypass grants an attacker the same trust the application would normally require credentials to obtain.
RemediationAI
Vendor-released patch: upgrade the UniFi Protect Application to version 7.1.83 or later, which is the primary and definitive fix per Ubiquiti Security Advisory Bulletin 066-066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc). Until the update is applied, reduce exposure by restricting network access to the UniFi Protect Application and its cameras to trusted management VLANs and removing any direct internet or untrusted-LAN reachability, since the attack requires network access - the trade-off is that legitimate remote or cross-segment viewing must instead route through a hardened VPN or the vendor's cloud path. Avoid exposing the Protect controller/console ports to broad network zones, accepting that tighter segmentation may complicate ad-hoc access for operators.
More in Unifi Protect Application
View allCommand injection in Ubiquiti's UniFi Protect Application lets a low-privileged, network-adjacent user run arbitrary ope
Command injection in Ubiquiti UniFi Protect Application lets a network-positioned, unauthenticated attacker run arbitrar
Privilege escalation via Server-Side Request Forgery in Ubiquiti's UniFi Protect Application allows a low-privileged, ne
Command injection in Ubiquiti's UniFi Protect Application lets a network-adjacent attacker holding only low-privileged c
Authentication bypass in Ubiquiti's UniFi Protect Application (versions before 7.1.83) allows a network-adjacent attacke
Privilege escalation in Ubiquiti's UniFi Protect Application is possible through an authenticated SQL injection (CWE-89)
Authentication bypass in Ubiquiti UniFi Protect Application lets a network-adjacent attacker reach certain API endpoints
Same weakness CWE-665 – Improper Initialization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today