Executive brief
Ubiquiti UniFi Network Application, which is used to manage and configure UniFi networking hardware, contains a security flaw that allows a user with low-level access to gain higher administrative privileges. An attacker who already has a basic account on the network could exploit this to take full control of the management application. This could lead to unauthorized changes to network settings, interception of traffic, or a complete shutdown of managed network services.
Technical details
An improper access control vulnerability (CWE-284) exists in the Ubiquiti UniFi Network Application. A remote attacker with low-privileged credentials can exploit this flaw via the network to escalate their privileges to a higher level within the application. The vulnerability is present in versions prior to 10.4.57. Successful exploitation grants the attacker unauthorized administrative capabilities, potentially leading to full compromise of the network management interface. The issue has been addressed in UniFi Network Application version 10.4.57.
Affected products
- Ubiquiti Inc UniFi Network Application versions before 10.4.57
Timeline
- 2026-07-02: disclosed
- 2026-07-02: advisory