Executive brief
Ubiquiti UniFi OS, which manages networking hardware such as routers and access points, contains a security flaw in its access control mechanisms. Under specific network configurations, an attacker with network access can bypass security restrictions to make unauthorized changes to the device. This could lead to a full compromise of the network management system, potentially allowing an attacker to intercept data or disrupt internet connectivity.
Technical details
An improper access control vulnerability (CWE-284) exists in Ubiquiti UniFi OS. The flaw allows a malicious actor with network access to bypass intended security restrictions and perform unauthorized modifications to the device's configuration. Exploitation is dependent on specific, non-default network configurations. The vulnerability has a CVSS 3.1 score of 8.1, reflecting high impact on confidentiality, integrity, and availability, though the attack complexity is rated as high. Users are advised to review their network configurations and apply any available firmware updates from Ubiquiti.
Affected products
- Ubiquiti UniFi OS
Timeline
- 2026-06-12: disclosed
- 2026-06-12: advisory