EUVD-2026-41387
GHSA-fcgm-88x5-cv87
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable management interface (AV:N) exploitable at low complexity by an authenticated low-privileged user (PR:L), yielding full compromise of the UniFi OS device (C/I/A:H), scope unchanged.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.
AnalysisAI
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged, network-adjacent user to chain a series of authenticated SQL injection flaws (CWE-89) to gain elevated privileges on affected UniFi OS instances and hardware. The issue affects UniFi OS Server and a broad range of Ubiquiti gateway, recorder, and Cloud Key appliances. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the CVSS 8.8 rating and low attack complexity make it a meaningful escalation risk once an attacker has any authenticated foothold.
Technical ContextAI
UniFi OS is Ubiquiti's unified management operating system that runs on their Dream Machine/Router gateways, Cloud Gateways, Cloud Keys, network/enterprise video recorders, and the self-hosted UniFi OS Server, exposing web-based administration and API endpoints backed by a relational database. The root cause is CWE-89 (SQL Injection): user-controllable input reaches SQL statements without proper parameterization or sanitization, allowing an authenticated user to manipulate query logic. Because UniFi OS mediates authorization decisions through database-backed roles and records, injecting into these queries lets an attacker read or alter data used for access control, resulting in privilege escalation rather than a simple data-read. The affected CPE set spans ubiquiti_inc products including unifi_os_server, dream_machines, dream_routers, dream_wall, express_7, enterprise_fortress_gateway, cloud_keys, cloud_gateways, network_video_recorders, and enterprise_video_recorders.
RemediationAI
Patch available per vendor advisory: apply the UniFi OS updates described in Ubiquiti Security Advisory Bulletin 066-066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc) to each affected device and to any self-hosted UniFi OS Server; the exact fixed version numbers are not included in the provided input and should be read from that advisory before upgrading. Because exploitation requires an authenticated low-privileged account, primary compensating controls until patching is complete are to restrict who holds UniFi OS accounts, remove or disable unnecessary limited-privilege operator logins, and enforce strong unique credentials plus MFA on the management interface (trade-off: adds operator friction). Restrict network reachability of the UniFi OS administration/API interface to a dedicated management VLAN or VPN and block it from general user and internet-facing segments (trade-off: remote/cloud administration workflows may need reconfiguration). Enable and review audit logging on management accounts to detect anomalous query behavior. Avoid exposing UniFi OS management ports directly to the internet.
More in Network Attached Storage
View allAuthentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances runni
Command injection in Ubiquiti UniFi OS (all builds before 5.1.19) lets a low-privileged user on the same network run arb
Privilege escalation via Server-Side Request Forgery affects Ubiquiti UniFi OS devices and the UniFi OS Server across th
Authentication bypass in Ubiquiti UniFi OS devices allows a network-adjacent attacker to abuse a path traversal flaw (CW
Cross-site session abuse in Ubiquiti UniFi OS lets a remote attacker who lures an authenticated operator to a malicious
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today