UniFi Gateways EUVD-2026-84760

Exploitation requires network reachability to an affected UniFi gateway's vulnerable service/parser (per AV:N/AC:L/PR:N/UI:N - no authentication, no user interaction, low complexity), against the affected device families listed in the CPEs (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, UniFi Gateways). The practical limiting factor is exposure of the affected service: gateways whose management/service interface is confined to a trusted LAN are only exploitable by an actor already on that network, whereas internet- or untrusted-network-exposed interfaces are directly at risk. Impact is limited to Denial of Service (device crash/reboot) - no data exposure or code execution. No specific non-default configuration is named in the advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH) is internally consistent and describes a purely availability-impacting flaw: an unauthenticated, low-complexity, remote attacker reachable over the network can crash the device via CWE-674 Uncontrolled Recursion (stack/resource exhaustion). The HIGH score is driven entirely by A:H - there is no confidentiality or integrity impact, so this is a DoS-only issue, not an RCE. No EPSS score, no CISA KEV listing, and no POC are present in the input; the sole reference is Ubiquiti's own Security Advisory Bulletin-069, meaning severity is vendor-self-reported and not independently corroborated by NVD analysis or third parties. Real-world priority is moderate: exploitation prerequisites are genuinely low (no auth, no user interaction), which favors patching, but impact is limited to device crash/reboot rather than data compromise or code execution, and the flaw is only reachable by an actor who already has network access to a management/service interface on the gateway. Absent EPSS/KEV/POC signals, this is best treated as a real-but-bounded availability risk - prioritize for internet-exposed or untrusted-network-facing gateways, lower priority for gateways whose attack surface is confined to trusted LAN segments.

An attacker with network reachability to a UniFi gateway's exposed service sends a crafted message whose structure triggers unbounded recursive parsing on the device, exhausting the stack and crashing the process or rebooting the device. Because the CVSS vector is PR:N/UI:N/AC:L, no credentials or user interaction are needed, and a single malformed request can knock the gateway offline. No public proof-of-concept was identified at time of analysis.