EUVD-2026-41391
GHSA-ghgx-h467-6r25
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable management interface (AV:N) with low complexity and no user interaction, but requires a low-privilege authenticated account (PR:L); command execution on the host yields total C/I/A impact.
Primary rating from Vendor (hackerone).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.
Articles & Coverage 1
AnalysisAI
Command injection in Ubiquiti UniFi OS (all builds before 5.1.19) lets a low-privileged user on the same network run arbitrary operating-system commands on the underlying host device, giving full control of gateways, recorders, and Cloud Keys. The flaw stems from improper input validation (CWE-20) and carries high confidentiality, integrity, and availability impact (CVSS 8.8). There is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as none, but the technical impact is total and a vendor patch is already available.
Technical ContextAI
UniFi OS is the embedded Linux-based management operating system that runs Ubiquiti's networking and video product lines - Dream Machine/Router/Wall gateways, Cloud Gateways, Cloud Keys, Express 7, Enterprise Fortress Gateway, Enterprise Firewall Core, and Network/Enterprise Video Recorders, plus the self-hosted UniFi OS Server (per the ubiquiti_inc CPE entries). The root cause is CWE-20 Improper Input Validation: attacker-controlled input reaches a host command context without adequate sanitization, allowing shell metacharacters or arguments to be injected and executed by the OS. Because the injection runs on the host device itself, successful exploitation translates directly into control of the appliance's operating system rather than just the management application.
RemediationAI
Vendor-released patch: UniFi OS 5.1.19. Upgrade every affected device - Dream Machine/Router/Wall, Cloud Gateways, Cloud Keys, Express 7, Enterprise Fortress Gateway, Enterprise Firewall Core, UniFi OS Server, and the NVR/EVR/NAS lines - to 5.1.19 or later as described in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc). Because exploitation requires a low-privileged authenticated user with network access, effective interim compensating controls until patching is complete are: restrict the UniFi OS management interface to a dedicated management VLAN and trusted admin IPs (side effect: admins must connect from that segment), ensure the management UI and SSH are never exposed to the internet, and audit and reduce the number of low-privilege local accounts and revoke unnecessary ones (side effect: some delegated operators lose access). Enforcing strong, unique credentials and MFA on management accounts further limits who can reach the vulnerable authenticated surface.
More in Network Attached Storage
View allAuthentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances runni
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged, network-adjacent user to chain a series of authentica
Privilege escalation via Server-Side Request Forgery affects Ubiquiti UniFi OS devices and the UniFi OS Server across th
Authentication bypass in Ubiquiti UniFi OS devices allows a network-adjacent attacker to abuse a path traversal flaw (CW
Cross-site session abuse in Ubiquiti UniFi OS lets a remote attacker who lures an authenticated operator to a malicious
Same weakness CWE-20 – Improper Input Validation
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today