Dream Routers
Monthly
Unauthenticated network attackers can crash Ubiquiti UniFi gateway devices by sending crafted traffic that triggers an out-of-bounds write (CWE-787) in the affected firmware, producing a denial-of-service condition that can take the device offline or force a reboot. Tracked as CVE-2026-95862 with a CVSS 3.1 score of 7.5 (HIGH) and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, the flaw is reachable over the network without credentials or user interaction, but its impact is confined entirely to availability - no confidentiality or integrity loss, and no code execution or data disclosure is indicated. Affected product families per the vendor's CPE data include Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways; so far there is no public exploit identified at time of analysis and the issue has not been marked as confirmed actively exploited (CISA KEV).
Denial of service in Ubiquiti UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways) allows an unauthenticated remote attacker reachable over the network to crash the device by triggering uncontrolled recursion (CWE-674), rated CVSS 3.1 base 7.5 HIGH with impact confined to availability (C:N/I:N/A:H). Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials or user interaction are required and complexity is low; the practical gating factor is exposure of the affected service, so gateways with management/service interfaces reachable from the internet or untrusted networks are directly at risk while LAN-confined deployments are exploitable only by a host already on that segment. The outcome is limited to device crash/reboot with no data exposure or code execution; no public exploit identified at time of analysis and no KEV or EPSS data was provided.
Unauthenticated network attackers who can reach an affected Ubiquiti UniFi gateway can trigger an out-of-bounds read (CWE-125) that crashes the device, producing a denial-of-service condition rated 7.5 HIGH. The issue affects the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express/Express 7, and generic UniFi Gateway product lines, and no public exploit code was identified at time of analysis. Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no credentials, user interaction, or special configuration are required - the practical constraint is network exposure, since the attack surface shrinks considerably if the vulnerable service is bound only to a trusted LAN or management interface rather than the WAN or untrusted segments.
Denial of service in UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and other UniFi gateways) can be triggered by an unauthenticated network attacker who sends crafted input to a vulnerable interface, causing an out-of-bounds read (CWE-125) that crashes the device. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, but impact is limited to availability with no confidentiality or integrity loss. Exploitation requires the attacker to reach the exposed vulnerable service; if the affected parser listens only on LAN or management interfaces rather than the WAN, an internet-based attacker would need a foothold. No public exploit code or active exploitation has been identified at time of analysis.
Network-reachable out-of-bounds write in Ubiquiti UniFi gateway devices-including Dream Machine, Dream Router, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways-allows unauthenticated remote attackers to crash the device, causing a denial of service. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning availability-only impact with no confidentiality or integrity loss. No public exploit identified at time of analysis; Ubiquiti Security Advisory Bulletin 069 provides remediation guidance.
Unauthenticated remote attackers who can reach the network-facing services of certain Ubiquiti UniFi gateway devices can trigger an out-of-bounds write that crashes the device, producing a denial-of-service condition (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). The affected product lines span the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express, Express 7 and general UniFi Gateway families, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Exposure is bounded by network position: the CVSS vector confirms no authentication or user interaction is required, but the attacker must still be able to send traffic to the vulnerable service, so gateways whose attack surface is confined to trusted internal segments are materially less exposed than devices reachable from the WAN or other untrusted networks.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralization of CRLF sequences (CWE-93) to gain access to affected consoles and gateways. It impacts a broad line of UniFi OS devices - Cloud Keys, Dream Machines/Routers, Network Video Recorders, Cloud Gateways, Enterprise Firewall/Fortress and NAS appliances, and the UniFi OS Server. Vendor-rated CVSS 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by injecting CRLF sequences, granting full control over the appliance under certain conditions. It affects a broad range of UniFi OS platforms including Cloud Gateways, Dream Machines/Routers, Cloud Keys, and Enterprise NVR/NAS hardware. Reported by Ubiquiti with a CVSS of 9.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the high scope-changing impact makes it a priority to patch.
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances running the UniFi OS platform, where leftover Active Debug Code (CWE-489) lets an authenticated low-privilege actor with network access elevate their privileges on the device. The flaw is vendor-reported via Ubiquiti Security Advisory Bulletin 067 and carries a 9.0 CVSS driven by a security-scope change and full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the wide device footprint makes it a notable patch priority.
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate their rights to full administrative control, per Ubiquiti Security Advisory Bulletin 067 (CVE-2026-77536). The flaw stems from improper access control (CWE-284) and carries a near-maximum CVSS 9.9 due to a scope-changing impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to elevate to higher privileges on the affected device or instance due to an improper access control flaw. The issue spans Ubiquiti's core managed platforms - UniFi OS Server, Cloud Keys, Dream Machines/Routers, Cloud Gateways, NVR/Enterprise NVR, Enterprise NAS, and Enterprise Firewall/Fortress Gateway - and carries a critical CVSS 9.9 with a changed scope. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make it high priority.
Unauthorized configuration changes on Ubiquiti UniFi OS gateway devices (Dream Machines, Dream Routers, Cloud Gateways, Enterprise Firewall Core, Enterprise Fortress Gateway, Dream Wall and Express 7) are possible through an improper access control flaw that, under certain network configurations, lets a network-adjacent attacker alter device settings without proper authorization. Ubiquiti has released version 5.1.19 to fix the issue via Security Advisory Bulletin 066. There is no public exploit identified at time of analysis, EPSS probability is low (0.22%), and CISA SSVC records exploitation status as none, but the total technical impact and 9.8 CVSS rating make this a high-priority patch for exposed gateways.
Privilege escalation in UniFi OS running the UniFi Protect Application (versions below 5.1.19) allows a network-adjacent, low-privileged attacker to gain control of the underlying host device via improper access control. Affected hardware spans Ubiquiti's Dream Machines, Dream Wall, Dream Routers, Cloud Keys, Cloud Gateways, and Network/Enterprise Video Recorders. No public exploit identified at time of analysis; EPSS is low (0.19%) and CISA SSVC records no known exploitation, but the total technical impact and 8.8 CVSS make it a meaningful patch priority.
Privilege escalation via Server-Side Request Forgery affects Ubiquiti UniFi OS devices and the UniFi OS Server across the Dream Machine, Dream Router, Cloud Gateway, Cloud Key, Enterprise Fortress/Firewall, and NVR/EVR product lines running versions below 5.1.19. A low-privileged user with network access can coerce the device into making attacker-controlled internal requests, leveraging the SSRF to reach privileged internal services and elevate to higher privileges within the appliance. No public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and the flaw is not listed in CISA KEV, but a vendor patch is available.
Command injection in Ubiquiti UniFi OS (all builds before 5.1.19) lets a low-privileged user on the same network run arbitrary operating-system commands on the underlying host device, giving full control of gateways, recorders, and Cloud Keys. The flaw stems from improper input validation (CWE-20) and carries high confidentiality, integrity, and availability impact (CVSS 8.8). There is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as none, but the technical impact is total and a vendor patch is already available.
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged, network-adjacent user to chain a series of authenticated SQL injection flaws (CWE-89) to gain elevated privileges on affected UniFi OS instances and hardware. The issue affects UniFi OS Server and a broad range of Ubiquiti gateway, recorder, and Cloud Key appliances. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the CVSS 8.8 rating and low attack complexity make it a meaningful escalation risk once an attacker has any authenticated foothold.
Authentication bypass in Ubiquiti UniFi OS devices allows a network-adjacent attacker to abuse a path traversal flaw (CWE-22) to reach protected functionality without valid credentials, affecting a broad hardware line including Dream Machines/Routers/Wall, Cloud Gateways/Keys, Express 7, Enterprise Fortress Gateway, and the UniFi OS Server software. The CVSS 8.6 rating is driven by an unauthenticated, low-complexity network vector combined with a scope change (S:C), meaning the compromised authentication boundary exposes managed device data. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of affected consoles makes this a high-priority patch.
Cross-site session abuse in Ubiquiti UniFi OS lets a remote attacker who lures an authenticated operator to a malicious web page ride that user's active session to perform privileged actions on the device, stemming from a permissive CORS policy that trusts untrusted origins. The flaw affects UniFi OS Server and the console firmware running on Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Cloud Keys, Enterprise Fortress Gateway, Express 7, and Network/Enterprise Video Recorders. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; success hinges on social-engineering an already-logged-in admin (CVSS 7.5, UI:R, AC:H).
Unauthenticated network attackers can crash Ubiquiti UniFi gateway devices by sending crafted traffic that triggers an out-of-bounds write (CWE-787) in the affected firmware, producing a denial-of-service condition that can take the device offline or force a reboot. Tracked as CVE-2026-95862 with a CVSS 3.1 score of 7.5 (HIGH) and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, the flaw is reachable over the network without credentials or user interaction, but its impact is confined entirely to availability - no confidentiality or integrity loss, and no code execution or data disclosure is indicated. Affected product families per the vendor's CPE data include Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways; so far there is no public exploit identified at time of analysis and the issue has not been marked as confirmed actively exploited (CISA KEV).
Denial of service in Ubiquiti UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways) allows an unauthenticated remote attacker reachable over the network to crash the device by triggering uncontrolled recursion (CWE-674), rated CVSS 3.1 base 7.5 HIGH with impact confined to availability (C:N/I:N/A:H). Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials or user interaction are required and complexity is low; the practical gating factor is exposure of the affected service, so gateways with management/service interfaces reachable from the internet or untrusted networks are directly at risk while LAN-confined deployments are exploitable only by a host already on that segment. The outcome is limited to device crash/reboot with no data exposure or code execution; no public exploit identified at time of analysis and no KEV or EPSS data was provided.
Unauthenticated network attackers who can reach an affected Ubiquiti UniFi gateway can trigger an out-of-bounds read (CWE-125) that crashes the device, producing a denial-of-service condition rated 7.5 HIGH. The issue affects the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express/Express 7, and generic UniFi Gateway product lines, and no public exploit code was identified at time of analysis. Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no credentials, user interaction, or special configuration are required - the practical constraint is network exposure, since the attack surface shrinks considerably if the vulnerable service is bound only to a trusted LAN or management interface rather than the WAN or untrusted segments.
Denial of service in UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and other UniFi gateways) can be triggered by an unauthenticated network attacker who sends crafted input to a vulnerable interface, causing an out-of-bounds read (CWE-125) that crashes the device. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, but impact is limited to availability with no confidentiality or integrity loss. Exploitation requires the attacker to reach the exposed vulnerable service; if the affected parser listens only on LAN or management interfaces rather than the WAN, an internet-based attacker would need a foothold. No public exploit code or active exploitation has been identified at time of analysis.
Network-reachable out-of-bounds write in Ubiquiti UniFi gateway devices-including Dream Machine, Dream Router, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways-allows unauthenticated remote attackers to crash the device, causing a denial of service. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning availability-only impact with no confidentiality or integrity loss. No public exploit identified at time of analysis; Ubiquiti Security Advisory Bulletin 069 provides remediation guidance.
Unauthenticated remote attackers who can reach the network-facing services of certain Ubiquiti UniFi gateway devices can trigger an out-of-bounds write that crashes the device, producing a denial-of-service condition (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). The affected product lines span the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express, Express 7 and general UniFi Gateway families, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Exposure is bounded by network position: the CVSS vector confirms no authentication or user interaction is required, but the attacker must still be able to send traffic to the vulnerable service, so gateways whose attack surface is confined to trusted internal segments are materially less exposed than devices reachable from the WAN or other untrusted networks.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralization of CRLF sequences (CWE-93) to gain access to affected consoles and gateways. It impacts a broad line of UniFi OS devices - Cloud Keys, Dream Machines/Routers, Network Video Recorders, Cloud Gateways, Enterprise Firewall/Fortress and NAS appliances, and the UniFi OS Server. Vendor-rated CVSS 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by injecting CRLF sequences, granting full control over the appliance under certain conditions. It affects a broad range of UniFi OS platforms including Cloud Gateways, Dream Machines/Routers, Cloud Keys, and Enterprise NVR/NAS hardware. Reported by Ubiquiti with a CVSS of 9.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the high scope-changing impact makes it a priority to patch.
Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances running the UniFi OS platform, where leftover Active Debug Code (CWE-489) lets an authenticated low-privilege actor with network access elevate their privileges on the device. The flaw is vendor-reported via Ubiquiti Security Advisory Bulletin 067 and carries a 9.0 CVSS driven by a security-scope change and full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the wide device footprint makes it a notable patch priority.
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate their rights to full administrative control, per Ubiquiti Security Advisory Bulletin 067 (CVE-2026-77536). The flaw stems from improper access control (CWE-284) and carries a near-maximum CVSS 9.9 due to a scope-changing impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to elevate to higher privileges on the affected device or instance due to an improper access control flaw. The issue spans Ubiquiti's core managed platforms - UniFi OS Server, Cloud Keys, Dream Machines/Routers, Cloud Gateways, NVR/Enterprise NVR, Enterprise NAS, and Enterprise Firewall/Fortress Gateway - and carries a critical CVSS 9.9 with a changed scope. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make it high priority.
Unauthorized configuration changes on Ubiquiti UniFi OS gateway devices (Dream Machines, Dream Routers, Cloud Gateways, Enterprise Firewall Core, Enterprise Fortress Gateway, Dream Wall and Express 7) are possible through an improper access control flaw that, under certain network configurations, lets a network-adjacent attacker alter device settings without proper authorization. Ubiquiti has released version 5.1.19 to fix the issue via Security Advisory Bulletin 066. There is no public exploit identified at time of analysis, EPSS probability is low (0.22%), and CISA SSVC records exploitation status as none, but the total technical impact and 9.8 CVSS rating make this a high-priority patch for exposed gateways.
Privilege escalation in UniFi OS running the UniFi Protect Application (versions below 5.1.19) allows a network-adjacent, low-privileged attacker to gain control of the underlying host device via improper access control. Affected hardware spans Ubiquiti's Dream Machines, Dream Wall, Dream Routers, Cloud Keys, Cloud Gateways, and Network/Enterprise Video Recorders. No public exploit identified at time of analysis; EPSS is low (0.19%) and CISA SSVC records no known exploitation, but the total technical impact and 8.8 CVSS make it a meaningful patch priority.
Privilege escalation via Server-Side Request Forgery affects Ubiquiti UniFi OS devices and the UniFi OS Server across the Dream Machine, Dream Router, Cloud Gateway, Cloud Key, Enterprise Fortress/Firewall, and NVR/EVR product lines running versions below 5.1.19. A low-privileged user with network access can coerce the device into making attacker-controlled internal requests, leveraging the SSRF to reach privileged internal services and elevate to higher privileges within the appliance. No public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and the flaw is not listed in CISA KEV, but a vendor patch is available.
Command injection in Ubiquiti UniFi OS (all builds before 5.1.19) lets a low-privileged user on the same network run arbitrary operating-system commands on the underlying host device, giving full control of gateways, recorders, and Cloud Keys. The flaw stems from improper input validation (CWE-20) and carries high confidentiality, integrity, and availability impact (CVSS 8.8). There is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as none, but the technical impact is total and a vendor patch is already available.
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged, network-adjacent user to chain a series of authenticated SQL injection flaws (CWE-89) to gain elevated privileges on affected UniFi OS instances and hardware. The issue affects UniFi OS Server and a broad range of Ubiquiti gateway, recorder, and Cloud Key appliances. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the CVSS 8.8 rating and low attack complexity make it a meaningful escalation risk once an attacker has any authenticated foothold.
Authentication bypass in Ubiquiti UniFi OS devices allows a network-adjacent attacker to abuse a path traversal flaw (CWE-22) to reach protected functionality without valid credentials, affecting a broad hardware line including Dream Machines/Routers/Wall, Cloud Gateways/Keys, Express 7, Enterprise Fortress Gateway, and the UniFi OS Server software. The CVSS 8.6 rating is driven by an unauthenticated, low-complexity network vector combined with a scope change (S:C), meaning the compromised authentication boundary exposes managed device data. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of affected consoles makes this a high-priority patch.
Cross-site session abuse in Ubiquiti UniFi OS lets a remote attacker who lures an authenticated operator to a malicious web page ride that user's active session to perform privileged actions on the device, stemming from a permissive CORS policy that trusts untrusted origins. The flaw affects UniFi OS Server and the console firmware running on Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Cloud Keys, Enterprise Fortress Gateway, Express 7, and Network/Enterprise Video Recorders. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; success hinges on social-engineering an already-logged-in admin (CVSS 7.5, UI:R, AC:H).