EUVD-2026-41392
GHSA-j9mg-7mrv-2wwc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable SSRF exploitable by an authenticated low-privileged user (PR:L, AV:N, AC:L, UI:N) yielding privilege escalation confined to the device (S:U) with high C/I/A; SSVC 'partial' impact adds mild uncertainty to the H ratings.
Primary rating from Vendor (hackerone).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.
AnalysisAI
Privilege escalation via Server-Side Request Forgery affects Ubiquiti UniFi OS devices and the UniFi OS Server across the Dream Machine, Dream Router, Cloud Gateway, Cloud Key, Enterprise Fortress/Firewall, and NVR/EVR product lines running versions below 5.1.19. A low-privileged user with network access can coerce the device into making attacker-controlled internal requests, leveraging the SSRF to reach privileged internal services and elevate to higher privileges within the appliance. No public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and the flaw is not listed in CISA KEV, but a vendor patch is available.
Technical ContextAI
The root cause is CWE-918 (Server-Side Request Forgery): an application feature that fetches or forwards network requests fails to validate the destination, allowing an authenticated user to redirect those server-initiated requests to internal endpoints not normally reachable. UniFi OS is Ubiquiti's unified management operating system that runs the network controller, protect/NVR, and gateway services as co-located internal services on the same host, so an SSRF that pivots to loopback or internal management APIs can reach privileged control-plane functionality. The affected CPE set (cpe:2.3:a:ubiquiti_inc:unifi_os_server, dream_machines, dream_routers, cloud_gateways, cloud_keys, enterprise_fortress_gateway, dream_wall, express_7, network_video_recorders, enterprise_video_recorders) indicates the defect lives in the shared UniFi OS platform layer rather than a single hardware model.
RemediationAI
Vendor-released patch: UniFi OS 5.1.19. Upgrade all affected UniFi OS devices and any UniFi OS Server installations to 5.1.19 or later, as documented in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc). Because exploitation requires a low-privileged authenticated account, interim compensating controls where immediate patching is not possible include: restricting and auditing UniFi OS local/portal accounts to remove unnecessary low-privilege users (trade-off: may disrupt delegated administration), and limiting network reachability of the management interface to trusted administrative subnets or VPN rather than exposing it broadly (trade-off: remote/mobile admins lose direct access). Avoid exposing the controller UI/API to the internet. These controls reduce who can reach the SSRF entry point but do not remove the flaw, so treat them as temporary until 5.1.19 is deployed.
More in Network Attached Storage
View allAuthentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances runni
Command injection in Ubiquiti UniFi OS (all builds before 5.1.19) lets a low-privileged user on the same network run arb
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged, network-adjacent user to chain a series of authentica
Authentication bypass in Ubiquiti UniFi OS devices allows a network-adjacent attacker to abuse a path traversal flaw (CW
Cross-site session abuse in Ubiquiti UniFi OS lets a remote attacker who lures an authenticated operator to a malicious
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today