Unifi Protect Application
Monthly
Command injection in Ubiquiti's UniFi Protect Application lets a network-adjacent attacker holding only low-privileged credentials run arbitrary OS commands on the underlying host device. The CVSS 3.1 base score is 9.9 with a scope change, reflecting that a foothold in the application escalates into full control of the host operating system. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the near-maximal score and low exploitation barrier make it a high-priority patch.
Command injection in Ubiquiti UniFi Protect Application lets a network-positioned, unauthenticated attacker run arbitrary OS commands on the underlying host device, per the CVSS:3.1/AV:N/PR:N/UI:N vector and CWE-20 improper input validation root cause. The maximal 10.0 score reflects full confidentiality, integrity, and availability compromise with a scope change (S:C), meaning code executes on the host beyond the application boundary. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the trivial complexity and lack of authentication make it a top-priority patch for any exposed NVR.
Command injection in Ubiquiti's UniFi Protect Application lets a low-privileged, network-adjacent user run arbitrary operating-system commands on the host device (typically a UniFi NVR, Cloud Key, or Dream Machine running the Protect service). The CVSS 3.1 score of 9.9 reflects a scope change: an attacker who already holds a low-privilege application account escapes the application boundary to gain full control of the underlying host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Privilege escalation in Ubiquiti's UniFi Protect Application is possible through an authenticated SQL injection (CWE-89) reachable by a low-privileged user with network access, letting that attacker escalate privileges on the underlying host device with full confidentiality, integrity, and availability impact. The flaw was reported through HackerOne and disclosed in Ubiquiti Security Advisory Bulletin 066; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. With CVSS 8.8 (AV:N/AC:L/PR:L) it is a high-priority patch for any exposed NVR/Protect deployment.
Privilege escalation via Server-Side Request Forgery in Ubiquiti's UniFi Protect Application allows a low-privileged, network-adjacent attacker to coerce the application into making attacker-controlled requests and escalate to control of the host device. The CVSS 9.9 rating is driven by a scope change (S:C) plus full confidentiality, integrity, and availability impact, meaning the SSRF crosses a security boundary from the application into the underlying host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Authentication bypass in Ubiquiti's UniFi Protect Application (versions before 7.1.83) allows a network-adjacent attacker to access data streaming without valid credentials due to improper access control. An unauthenticated attacker on a reachable network can view video/data streams that should be protected, with SSVC flagging the flaw as automatable. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.27%), but the CVSS 9.8 rating and network exposure make it a meaningful patch priority.
Authentication bypass in Ubiquiti UniFi Protect Application (versions prior to 7.1.83) allows a network-adjacent attacker to circumvent authentication controls on UniFi Protect Cameras via an improper initialization flaw. The bypass yields total compromise of camera confidentiality, integrity, and availability, though exploitation depends on certain unspecified conditions and carries high attack complexity. No public exploit is identified at time of analysis, and EPSS probability is low (0.24%), consistent with the CISA SSVC assessment of no known exploitation.
Authentication bypass in Ubiquiti UniFi Protect Application lets a network-adjacent attacker reach certain API endpoints without valid credentials due to improper access control (CWE-284). Rated CVSS 8.6, the flaw combines low confidentiality and integrity impact with high availability impact, meaning an unauthenticated actor on the network could interact with protected surveillance-management functions. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the network vector with no privileges required (AV:N/PR:N) makes it a meaningful exposure for internet- or LAN-reachable deployments.
Command injection in Ubiquiti's UniFi Protect Application lets a network-adjacent attacker holding only low-privileged credentials run arbitrary OS commands on the underlying host device. The CVSS 3.1 base score is 9.9 with a scope change, reflecting that a foothold in the application escalates into full control of the host operating system. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the near-maximal score and low exploitation barrier make it a high-priority patch.
Command injection in Ubiquiti UniFi Protect Application lets a network-positioned, unauthenticated attacker run arbitrary OS commands on the underlying host device, per the CVSS:3.1/AV:N/PR:N/UI:N vector and CWE-20 improper input validation root cause. The maximal 10.0 score reflects full confidentiality, integrity, and availability compromise with a scope change (S:C), meaning code executes on the host beyond the application boundary. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the trivial complexity and lack of authentication make it a top-priority patch for any exposed NVR.
Command injection in Ubiquiti's UniFi Protect Application lets a low-privileged, network-adjacent user run arbitrary operating-system commands on the host device (typically a UniFi NVR, Cloud Key, or Dream Machine running the Protect service). The CVSS 3.1 score of 9.9 reflects a scope change: an attacker who already holds a low-privilege application account escapes the application boundary to gain full control of the underlying host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Privilege escalation in Ubiquiti's UniFi Protect Application is possible through an authenticated SQL injection (CWE-89) reachable by a low-privileged user with network access, letting that attacker escalate privileges on the underlying host device with full confidentiality, integrity, and availability impact. The flaw was reported through HackerOne and disclosed in Ubiquiti Security Advisory Bulletin 066; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. With CVSS 8.8 (AV:N/AC:L/PR:L) it is a high-priority patch for any exposed NVR/Protect deployment.
Privilege escalation via Server-Side Request Forgery in Ubiquiti's UniFi Protect Application allows a low-privileged, network-adjacent attacker to coerce the application into making attacker-controlled requests and escalate to control of the host device. The CVSS 9.9 rating is driven by a scope change (S:C) plus full confidentiality, integrity, and availability impact, meaning the SSRF crosses a security boundary from the application into the underlying host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Authentication bypass in Ubiquiti's UniFi Protect Application (versions before 7.1.83) allows a network-adjacent attacker to access data streaming without valid credentials due to improper access control. An unauthenticated attacker on a reachable network can view video/data streams that should be protected, with SSVC flagging the flaw as automatable. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.27%), but the CVSS 9.8 rating and network exposure make it a meaningful patch priority.
Authentication bypass in Ubiquiti UniFi Protect Application (versions prior to 7.1.83) allows a network-adjacent attacker to circumvent authentication controls on UniFi Protect Cameras via an improper initialization flaw. The bypass yields total compromise of camera confidentiality, integrity, and availability, though exploitation depends on certain unspecified conditions and carries high attack complexity. No public exploit is identified at time of analysis, and EPSS probability is low (0.24%), consistent with the CISA SSVC assessment of no known exploitation.
Authentication bypass in Ubiquiti UniFi Protect Application lets a network-adjacent attacker reach certain API endpoints without valid credentials due to improper access control (CWE-284). Rated CVSS 8.6, the flaw combines low confidentiality and integrity impact with high availability impact, meaning an unauthenticated actor on the network could interact with protected surveillance-management functions. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the network vector with no privileges required (AV:N/PR:N) makes it a meaningful exposure for internet- or LAN-reachable deployments.