EUVD-2026-84753
GHSA-cgjh-gg68-hw7w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach gateway over network
-
DeliverySend crafted malformed packets
-
ExploitTrigger out-of-bounds write
-
ExecutionCorrupt memory / crash service
-
ImpactGateway denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to an affected UniFi gateway device (Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express, Express 7, or UniFi Gateway) - no authentication, no user interaction, and default configurations are sufficient per the CVSS vector (PR:N/UI:N/AC:L). The primary limiting factor is network position: the attacker must be able to send traffic to the vulnerable service, so gateways whose management/attack surface is confined to trusted internal segments are far less exposed than those reachable from the WAN or untrusted networks. Impact is limited to Denial of Service (device/service crash); no data disclosure or code execution is claimed by the vendor. |
| Impact | This is a genuine but bounded availability risk, not a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) describes remote, unauthenticated, low-complexity exploitation with no user interaction, which is what drives the score entirely - the impact is availability-only (C:N/I:N), so despite CWE-787 (Out-of-bounds Write) being a class that can lead to code execution, Ubiquiti scopes this strictly to Denial of Service. That is the key tension to note: CWE-787 write primitives often imply integrity/RCE potential, yet the vendor asserts crash-only impact (I:N); this should be verified against the advisory rather than assumed benign, but the assigned vector is taken at face value here. There is NO EPSS score, NO CISA KEV listing, and NO public exploit in the provided data - exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The advisory is Ubiquiti self-reported (single reference, Security Advisory Bulletin 069) with no independent corroboration and no fixed-version string. Net: a network-reachable UniFi gateway could be crashed by an unauthenticated attacker, but with no exploitation evidence and availability-only impact, this ranks as a patch-in-normal-cycle item rather than an emergency - elevated only for internet-exposed or WAN-facing gateway management/data planes. |
| Exploit ScenarioDerived | An attacker with network access to a UniFi gateway (e.g., reachable on the WAN interface or an adjacent network segment) sends crafted packets that trigger an out-of-bounds write in the affected gateway firmware, corrupting memory and crashing the device or a critical service. This drops network connectivity for everything behind the gateway until it recovers or is rebooted. No public proof-of-concept is identified in the provided data, and no authentication is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Unauthenticated remote attackers who can reach the network-facing services of certain Ubiquiti UniFi gateway devices can trigger an out-of-bounds write that crashes the device, producing a denial-of-service condition (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). The affected product lines span the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express, Express 7 and general UniFi Gateway families, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Exposure is bounded by network position: the CVSS vector confirms no authentication or user interaction is required, but the attacker must still be able to send traffic to the vulnerable service, so gateways whose attack surface is confined to trusted internal segments are materially less exposed than devices reachable from the WAN or other untrusted networks.
RemediationAI
Apply the firmware update described in Ubiquiti's Security Advisory Bulletin 069 (https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c); the advisory is the authoritative source for the exact patched firmware versions per hardware model, and the provided data does not specify a fixed version number, so patch status should be described as vendor advisory available with the precise build to be confirmed against that bulletin rather than assumed. Until the update is applied, the most effective compensating control is reducing reachability of the gateway's network-facing services: block inbound WAN access to the device's management and exposed service ports at the upstream firewall, and keep remote/cloud management interfaces restricted to trusted administrator networks or a VPN. The trade-off is operational - remote administration and cloud-based management become less convenient or require an always-on VPN path - but it directly removes the AV:N exposure that the CVSS vector identifies as the primary prerequisite. Segmenting the gateway's management plane onto a dedicated VLAN and restricting who can route to it limits lateral exposure from compromised internal hosts, at the cost of additional network design and possible disruption to existing management workflows. Because the impact is availability-only, monitoring for unexpected device reboots or gateway process restarts provides a useful detection signal, and organizations that cannot patch immediately should treat reboot storms on these appliances as a potential exploitation indicator.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 8 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is an out-of-bounds write (CWE-787) in the software handling network traffic on UniFi gateway platforms - a memory-corruption class defect in which data is written past the end of an allocated buffer, typically because a length or offset derived from attacker-supplied input is not validated against the destination buffer size. The CPE data covers a broad set of Ubiquiti gateway product families (ubiquiti_inc:dream_machines, enterprise_firewalls, dream_routers, cloud_gateways, dream_wall, express, express_7, and unifi_gateways), all with wildcarded version fields, indicating the flaw affects the current firmware lines for these platforms rather than a single SKU. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U with C:N/I:N/A:H, the defect is reachable over the network without credentials or user interaction, and the demonstrated consequence is limited to service/device unavailability - the vendor's advisory describes a Denial of Service outcome only, and no confidentiality or integrity impact (and no code execution) is claimed. In practice this means the corruption path terminates in a crash or hang of the affected gateway process rather than a controllable write primitive, though memory-corruption bugs of this class warrant prompt patching because adjacent code paths can behave unpredictably.
Know when Express gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated low-complexity network trigger (AV:N/AC:L/PR:N/UI:N) with vendor-scoped crash-only impact yields A:H and C:N/I:N; agrees with the assigned 7.5.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
Articles & Coverage 2
Executive ViewAI
Ubiquiti UniFi gateway devices (Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express, Express 7, and general UniFi Gateway families) are vulnerable to an unauthenticated remote denial-of-service attack that can crash the device, disrupting network connectivity. With no public exploit identified at time of analysis, organizations relying on these gateways for critical network infrastructure face potential outages, particularly if devices are reachable from untrusted networks. Leadership should prioritize identifying affected devices and restricting their network exposure to mitigate business disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the vulnerable services on affected Ubiquiti UniFi gateway devices to trusted internal segments only; implement firewall rules to block untrusted WAN traffic to management interfaces; monitor devices for unexpected crashes or reboots; and consider network segmentation to isolate gateways from untrusted networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Denial of Service vulnerability in Multer (Node.js multipart form-data middleware) affecting versions 1.4.4-lts.1 throug
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive
Unauthenticated network attackers can crash Ubiquiti UniFi gateway devices by sending crafted traffic that triggers an o
Denial of service in Ubiquiti UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterpri
Unauthenticated network attackers who can reach an affected Ubiquiti UniFi gateway can trigger an out-of-bounds read (CW
Denial of service in UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewa
Exploit-DB