Executive brief
Ubiquiti UniFi OS, which powers various networking devices like routers and controllers, contains a critical security flaw. An attacker with basic network access and low-level user credentials can take complete control of the device. This could lead to the theft of sensitive data, disruption of network services, or a total compromise of the corporate network infrastructure managed by the device.
Technical details
An improper input validation vulnerability (CWE-20) exists in certain versions of Ubiquiti UniFi OS. The flaw allows an authenticated attacker with low privileges to inject and execute arbitrary commands on the underlying operating system via the network. The vulnerability is characterized by a high CVSS score of 9.9 due to its potential for full system compromise and scope change, meaning an attacker can move from the application layer to the host operating system. Users are advised to refer to Ubiquiti Security Advisory Bulletin 065 for specific version impact and patching information.
Affected products
- Ubiquiti UniFi OS
Timeline
- 2026-06-12: disclosed: Initial publication of the CVE record via HackerOne and NVD.
- 2026-06-12: advisory: Ubiquiti released Security Advisory Bulletin 065.