EUVD-2026-66393Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable command injection needing only low-privilege auth (PR:L) and no interaction, executing on the host OS (S:C) for full C/I/A impact.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.
AnalysisAI
Command injection in Ubiquiti's UniFi Protect Application lets a network-adjacent attacker holding only low-privileged credentials run arbitrary OS commands on the underlying host device. The CVSS 3.1 base score is 9.9 with a scope change, reflecting that a foothold in the application escalates into full control of the host operating system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the UniFi Protect Application plus valid low-privileged credentials (CVSS PR:L) - it is not fully unauthenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a low-privileged UniFi Protect account - for example a limited camera-viewer login or a foothold on the same reachable network - submits crafted input to a Protect function that fails to validate it, causing the payload to be executed as an OS command on the host appliance. This yields command execution on the device itself, from which the attacker can pivot to the surveillance data, tamper with recordings, or use the appliance as a foothold into the network. … |
| Remediation | Upgrade the UniFi Protect Application to the fixed release identified in Ubiquiti's Security Advisory Bulletin 067 (https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9); the exact patched version is not stated in the available data, so verify the target build directly from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all UniFi Protect deployments in your environment and document network-adjacent access points and credential distribution. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Unifi Protect Application
View allCommand injection in Ubiquiti's UniFi Protect Application lets a low-privileged, network-adjacent user run arbitrary ope
Command injection in Ubiquiti UniFi Protect Application lets a network-positioned, unauthenticated attacker run arbitrar
Privilege escalation via Server-Side Request Forgery in Ubiquiti's UniFi Protect Application allows a low-privileged, ne
Authentication bypass in Ubiquiti's UniFi Protect Application (versions before 7.1.83) allows a network-adjacent attacke
Privilege escalation in Ubiquiti's UniFi Protect Application is possible through an authenticated SQL injection (CWE-89)
Authentication bypass in Ubiquiti UniFi Protect Application lets a network-adjacent attacker reach certain API endpoints
Authentication bypass in Ubiquiti UniFi Protect Application (versions prior to 7.1.83) allows a network-adjacent attacke
Same weakness CWE-20 – Improper Input Validation
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today