What is the CVSS score of EUVD-2026-84755?

EUVD-2026-84755 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate EUVD-2026-84755?

Within 24 hours, inventory all affected UniFi gateway models (Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express, and Express 7) across every site, confirm which of them expose management or gateway interfaces to the internet, and restrict those interfaces to trusted management networks or VPN-only access using firewall rules and UniFi's remote access controls. Within 7 days, enable automatic firmware update notifications and subscribe to Ubiquiti's security advisory channel and CISA alerts for CVE-2026-77556, deploy network monitoring that alerts on unexpected gateway reboots or interface drops so crashes are detected immediately, and document a manual power-cycle/recovery runbook with on-site or out-of-band access instructions for each location since no vendor-released patch has been identified at time of analysis. Within 30 days, apply the vendor firmware once Ubiquiti publishes it, revalidate that all management planes remain segmented from untrusted networks, and for sites where the vulnerable parser must stay internet-facing, place the gateway behind an upstream filtering device or ISP-provided scrubbing service and consider redundant or failover WAN paths so a single device crash does not fully isolate the site.

UniFi Gateways EUVD-2026-84755

Q: Which versions of UniFi Gateways are affected by EUVD-2026-84755?

An unpatched denial-of-service flaw affects the UniFi gateway appliances that many organizations rely on as the network edge for branch offices, retail sites, and small campuses - Dream Machines,…. A patch is available.

| CVE-2026-77556 HIGH

Out-of-bounds Read (CWE-125)

2026-09-22 Ubiquiti

GHSA-rf8m-f7x4-4m54

Buffer Overflow Denial Of Service Express Ubiquiti Express 7 Dream Machines Dream Wall Dream Routers Cloud Gateways Ubiquiti Inc Enterprise Firewalls Unifi Gateways

7.5

CVSS 3.1 · Vendor: Ubiquiti

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain network access to gateway
Delivery

Send crafted malformed packet
Exploit

Trigger out-of-bounds read in parser
Execution

Crash service or device
Impact

Denial of service on gateway

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires network reachability to an affected UniFi gateway device (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and other UniFi gateways) and the ability to send crafted input to the vulnerable service. No authentication and no user interaction are needed (PR:N/UI:N). Limiting factors: the attacker must be able to reach the exposed vulnerable interface/service - if the affected parser is only listening on LAN or management interfaces rather than the WAN, an internet-based attacker cannot reach it without a foothold; impact is confined to availability (device crash/DoS), with no code execution or data access.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a network-reachable, low-complexity, unauthenticated flaw whose sole impact is availability - a device-level Denial of Service via CWE-125 out-of-bounds read. The 7.5 base score is driven entirely by A:H; there is no confidentiality or integrity impact, so despite the 'Information Disclosure' tag this is not a data-exposure issue. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so this is 'no public exploit identified at time of analysis' rather than active exploitation. Real-world priority is moderate: exploitation is easy in principle (unauthenticated network reach, low complexity) but the payoff is limited to crashing/rebooting the gateway rather than code execution or data theft. The main risk consideration is that the affected products are edge/gateway devices, so a crash can disrupt an entire network segment. Missing signals to verify with the vendor: exact fixed firmware versions, whether the vulnerable parser is exposed on the WAN or only LAN/management interfaces, and whether repeated exploitation causes persistent outage versus a self-recovering restart.
Exploit ScenarioDerived	An attacker with network reachability to a UniFi gateway (e.g., on an exposed service interface) sends a crafted packet or request that triggers an out-of-bounds read in a device service. The malformed input causes the process or device to crash, taking the gateway offline and disrupting network connectivity for everything behind it. No authentication or user interaction is required, but no public proof-of-concept is identified in the available data.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 22, 2026

Denial of service in UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and other UniFi gateways) can be triggered by an unauthenticated network attacker who sends crafted input to a vulnerable interface, causing an out-of-bounds read (CWE-125) that crashes the device. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, but impact is limited to availability with no confidentiality or integrity loss. Exploitation requires the attacker to reach the exposed vulnerable service; if the affected parser listens only on LAN or management interfaces rather than the WAN, an internet-based attacker would need a foothold. No public exploit code or active exploitation has been identified at time of analysis.

RemediationAI

Apply the firmware updates specified in Ubiquiti Security Advisory Bulletin 069 (https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c) to all affected UniFi gateway devices. Because no exact fixed version is provided in the input data, verify the advisory for the minimum patched firmware release before upgrading. If immediate patching is not possible, reduce exposure by ensuring the vulnerable service is not reachable from untrusted networks: restrict WAN access to the device's management interface, block inbound traffic to the affected service on the WAN, and limit LAN/management access to trusted hosts. These compensating controls may reduce manageability and are not a substitute for the vendor fix. Monitor device logs for unexpected crashes or reboots as a detection measure. No public exploit code has been identified, but the flaw is network-reachable and low-complexity, so timely patching is advised.

Affected VersionsENISA

UniFi Gateways 0 <5.1.26

Dream Routers 0 <5.1.31

Dream Wall 0 <5.1.31

Express 7 0 <5.1.31

Cloud Gateways 0 <5.1.31

express 0 <4.0.21

Dream Machines 0 <5.1.31

Enterprise Firewalls 0 <5.1.31

Affected Packages

euvd cloud_gateways fix: 5.1.31

euvd dream_machines fix: 5.1.31

euvd dream_routers fix: 5.1.31

euvd dream_wall fix: 5.1.31

euvd enterprise_firewalls fix: 5.1.31

euvd express fix: 4.0.21

euvd express_7 fix: 5.1.31

euvd unifi_gateways fix: 5.1.26

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 8 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause is an out-of-bounds read (CWE-125) in the firmware of multiple UniFi gateway product families. An OOB read occurs when software reads memory beyond an allocated buffer, typically while parsing packet or protocol data; in this case it leads to a device crash and availability impact rather than code execution or data access. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms network reachability and no authentication requirement, but the assessed exploitation conditions note that the attacker must be able to reach the vulnerable interface - if the parser is bound only to LAN or management interfaces, WAN-based exploitation is not possible without an internal foothold. CPE entries identify affected product lines as Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and other UniFi gateways, all with unspecified versions (:*). Although supplied tags include Buffer Overflow and Information Disclosure, the CVE description and CWE-125 classification combined with the assessed CVSS impact (C:N/I:N/A:H) indicate the practical effect is a denial of service; any memory disclosure potential is theoretical and not assessed.

Know when Express gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Ubiquiti) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 7.5 HIGH

Network-reachable, unauthenticated, low-complexity out-of-bounds read causing device DoS; availability-only impact so C:N/I:N/A:H, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Ubiquiti).

CVSS VectorVendor: Ubiquiti

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Sep 22, 2026 - 20:18 EUVD

CVE Published

Sep 22, 2026 - 18:41 cve.org

HIGH 7.5

DescriptionCVE.org

A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.

Articles & Coverage 2

News 6 New Ubiquiti Vulnerabilities - 6 High Severity, No Public POC Sep 23, 2026 News 6 New Ubiquiti Vulnerabilities - All High Severity, None With POC Sep 22, 2026

Executive ViewAI

Why It Matters

An unpatched denial-of-service flaw affects the UniFi gateway appliances that many organizations rely on as the network edge for branch offices, retail sites, and small campuses - Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, and Express models. A single crafted network request requiring no credentials can crash the device, cutting off all internet and inter-site connectivity for every user and service behind it until the unit is manually restarted. Because the defect is in a core network appliance rather than an end-user system, leadership should treat it as a site-wide availability risk with operational and revenue consequences, even though no data theft or tampering is possible and no public exploit code or active exploitation has been identified at time of analysis.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict the vulnerable interface to trusted management networks or VPN-only access; block internet-sourced traffic to gateway management/parser ports at the upstream firewall; segment management planes from untrusted networks; enable gateway reboot/availability monitoring with immediate alerting; maintain an out-of-band or on-site recovery procedure for manual power-cycling; and configure redundant WAN or failover paths so a single device crash does not fully isolate a site.

Threat Intelligence Overview

EPSS Score

0.5%

Top 61% exploitable

Prevalence

High

UniFi gateways/firewalls are widely deployed in SMB and prosumer networks

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.