Uid Enterprise Agent
Monthly
Command injection in Ubiquiti's UID Enterprise Agent lets a high-privileged, network-adjacent actor run arbitrary OS commands on the host device by supplying improperly validated input. The flaw carries a CVSS 9.1 rating driven by a scope change and full compromise of confidentiality, integrity, and availability, though exploitation requires existing high privileges (PR:H). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Command injection in Ubiquiti UID Enterprise Agent allows a low-privileged attacker with network access to execute arbitrary commands on the host device by abusing improper input validation. The CVSS 9.9 score reflects a scope change with high confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Defenders should treat this as a high-priority patch item given the low attack complexity and minimal privilege requirement.
Command injection in Ubiquiti's UID Enterprise Agent lets a high-privileged, network-adjacent actor run arbitrary OS commands on the host device by supplying improperly validated input. The flaw carries a CVSS 9.1 rating driven by a scope change and full compromise of confidentiality, integrity, and availability, though exploitation requires existing high privileges (PR:H). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Command injection in Ubiquiti UID Enterprise Agent allows a low-privileged attacker with network access to execute arbitrary commands on the host device by abusing improper input validation. The CVSS 9.9 score reflects a scope change with high confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Defenders should treat this as a high-priority patch item given the low attack complexity and minimal privilege requirement.