Executive brief
A vulnerability in Ubiquiti UniFi OS devices allows an authorized user with high-level administrative privileges to execute unauthorized commands on the underlying operating system. UniFi OS is the management software for Ubiquiti networking hardware, such as routers and switches. If exploited, an attacker could gain full control over the device, potentially leading to network-wide disruptions or unauthorized access to sensitive traffic.
Technical details
An improper input validation vulnerability (CWE-20) exists in Ubiquiti UniFi OS devices. The flaw allows a remote attacker with high-level administrative privileges to bypass input filters and inject arbitrary commands into the system shell. The vulnerability is reachable via the network and does not require user interaction. Successful exploitation results in a complete compromise of the device's integrity, confidentiality, and availability, with the potential for impact to extend beyond the affected component to the wider network environment (Scope: Changed).
Affected products
- Ubiquiti UniFi OS
Timeline
- 2026-05-22: advisory: NVD publication date