EUVD-2026-66390
GHSA-4c82-32w7-vxc8
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Network-reachable but needs a low-priv account (PR:L) and user interaction (UI:R); the vendor's 'under certain conditions' implies AC:H, and container/scope breakout with full device compromise gives S:C and C/I/A:H.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
AnalysisAI
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances running the UniFi OS platform, where leftover Active Debug Code (CWE-489) lets an authenticated low-privilege actor with network access elevate their privileges on the device. The flaw is vendor-reported via Ubiquiti Security Advisory Bulletin 067 and carries a 9.0 CVSS driven by a security-scope change and full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated low-privilege account on the UniFi OS device (CVSS PR:L) and network access to it (AV:N), plus a user interaction (UI:R) to trigger the debug code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed but lean toward real priority given the deployment footprint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who already holds a low-privilege account on a UniFi OS appliance (for example a limited operator role on a Dream Machine or Cloud Key) reaches the device over the network and, once the required user interaction and specific conditions are met, invokes the leftover debug code path to break out of its restricted context and gain elevated privileges on the underlying host. No public exploit is identified at time of analysis, so this would currently require original research. |
| Remediation | Patch available per vendor advisory: apply the UniFi OS updates referenced in Ubiquiti Security Advisory Bulletin 067 (https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9) to every affected appliance - UniFi OS Server, Cloud Keys, NVR/Enterprise NVR, Enterprise NAS, Dream Machines/Routers/Wall, Express 7, Enterprise Firewall Core, Enterprise Fortress Gateway, and Cloud Gateways - and confirm the fixed build number from that bulletin since exact versions are not in this dataset. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all UniFi OS appliances deployed across your network infrastructure and verify against Ubiquiti Security Advisory Bulletin 067 to determine which versions are affected. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Unifi Os Server
View allUnauthenticated command injection in Ubiquiti UniFi OS devices allows remote attackers with network access to execute ar
Path traversal in Ubiquiti UniFi OS devices allows network-adjacent attackers to read sensitive files from the underlyin
Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configur
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to
Command injection in Ubiquiti UniFi OS devices allows a high-privileged attacker on the network to execute arbitrary ope
Command injection in Ubiquiti UniFi OS Server allows an attacker holding high-privilege access and network reachability
Command injection in Ubiquiti UniFi OS Server allows an attacker holding high-privilege (administrative) access on the n
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Same weakness CWE-489 – Active Debug Code
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today