7.7

CVE-2026-34911

Medienbericht
A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ui ≫ Unifi Os Server Version < 5.0.8
Ui ≫ Unifi Dream Machine Firmware Version < 5.1.12
   Ui ≫ Unifi Dream Machine Version-
Ui ≫ Unifi Dream Machine Pro Firmware Version < 5.1.12
   Ui ≫ Unifi Dream Machine Pro Version-
Ui ≫ Unifi Dream Wall Firmware Version < 5.1.12
   Ui ≫ Unifi Dream Wall Version-
Ui ≫ Unifi Dream Router Firmware Version < 5.1.12
   Ui ≫ Unifi Dream Router Version-
Ui ≫ Unifi Dream Router 7 Firmware Version < 5.1.12
   Ui ≫ Unifi Dream Router 7 Version-
Ui ≫ Unifi Express 7 Firmware Version < 5.1.12
   Ui ≫ Unifi Express 7 Version-
Ui ≫ Unifi Cloud Gateway Ultra Firmware Version < 5.1.12
   Ui ≫ Unifi Cloud Gateway Ultra Version-
Ui ≫ Unifi Cloud Gateway Max Firmware Version < 5.1.12
   Ui ≫ Unifi Cloud Gateway Max Version-
Ui ≫ Unifi Cloud Gateway Fiber Firmware Version < 5.1.12
   Ui ≫ Unifi Cloud Gateway Fiber Version-
Ui ≫ Unifi Dream Router 5g Max Firmware Version < 5.1.12
   Ui ≫ Unifi Dream Router 5g Max Version-
Ui ≫ Unifi Cloud Key Plus Firmware Version < 5.1.12
   Ui ≫ Unifi Cloud Key Plus Version-
Ui ≫ Unifi Cloudkey Firmware Version < 5.1.12
   Ui ≫ Unifi Cloudkey Version-
Ui ≫ Unifi Cloudkey Enterprise Firmware Version < 5.1.12
   Ui ≫ Unifi Cloudkey Enterprise Version-
Ui ≫ Unifi Dream Machine Beast Firmware Version < 5.1.11
   Ui ≫ Unifi Dream Machine Beast Version-
Ui ≫ Unas 2 Firmware Version < 5.1.10
   Ui ≫ Unas 2 Version-
Ui ≫ Unas 4 Firmware Version < 5.1.10
   Ui ≫ Unas 4 Version-
Ui ≫ Unas Pro Firmware Version < 5.1.10
   Ui ≫ Unas Pro Version-
Ui ≫ Unas Pro 4 Firmware Version < 5.1.10
   Ui ≫ Unas Pro 4 Version-
Ui ≫ Unas Pro 8 Firmware Version < 5.1.10
   Ui ≫ Unas Pro 8 Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.68% 0.477
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
support@hackerone.com 7.7 3.1 4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
05.06.2026 12:45
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
05.06.2026 12:44
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
05.06.2026 12:43
https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b
Patch
Vendor Advisory