UniFi OS EUVD-2026-66382

Exploitation requires the attacker to already hold a low-privileged, authenticated account on the target UniFi OS device or instance (CVSS PR:L) and network access to its management interface (AV:N); no user interaction and no special non-default feature toggle is called out in the description, so default-configured devices with any low-tier account are exposed. What limits exploitation: the attacker must first obtain valid low-privilege credentials and be able to route to the UniFi OS console/API, so devices whose management plane is isolated to a trusted VLAN/VPN and that issue no secondary user accounts are substantially harder to reach. The flaw affects the UniFi OS platform generally rather than a single opt-in feature, so exposure is broad across the listed product families.

The signals align toward genuine high priority: the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C, C:H/I:H/A:H) describes a remotely reachable, low-complexity flaw needing only a low-privileged account and no user interaction, with a scope change indicating impact beyond the initially authorized boundary - hence the 9.9 rating. Countervailing this, there is no CISA KEV listing and no published proof-of-concept, and no EPSS score is provided, so exploitation is not confirmed and probability cannot be independently quantified; the risk is currently derived from the vector and vendor advisory rather than observed attacks. The realistic threat model is any environment where semi-trusted users, guest/staff accounts, or compromised low-tier credentials can reach the UniFi OS console - a mid-sized municipal or campus IT team should treat this as urgent because a single low-privileged foothold converts into full device compromise. Overall this is a real priority (not a high-CVSS-but-low-real-risk case), tempered only by the absence of confirmed in-the-wild exploitation.

An attacker who has obtained a low-privileged UniFi OS account - for example a limited staff operator login, a guest-tier management account, or reused/leaked credentials - connects to the device's web console or API over the network and invokes functionality that should be gated behind an administrator role. Because the access control check is improperly enforced, the request succeeds and the attacker gains elevated privileges over the device, potentially taking full control of the gateway, NVR, or UniFi OS Server. No public proof-of-concept is available at time of analysis, but the low complexity means exploitation would be straightforward once the flawed endpoint is known.