8.8

CVE-2026-54401

A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ui ≫ Unifi Os Server Version <= 5.1.15
Ui ≫ Unifi Dream Machine Firmware Version <= 5.1.15
   Ui ≫ Unifi Dream Machine Version -
Ui ≫ Unifi Dream Machine Pro Firmware Version <= 5.1.15
   Ui ≫ Unifi Dream Machine Pro Version -
Ui ≫ Unifi Dream Machine Pro Max Firmware Version <= 5.1.15
   Ui ≫ Unifi Dream Machine Pro Max Version -
Ui ≫ Unifi Dream Machine Beast Firmware Version <= 5.1.15
   Ui ≫ Unifi Dream Machine Beast Version -
Ui ≫ Enterprise Fortress Gateway Firmware Version <= 5.1.15
   Ui ≫ Enterprise Fortress Gateway Version -
Ui ≫ Unifi Dream Router Firmware Version <= 5.1.15
   Ui ≫ Unifi Dream Router Version -
Ui ≫ Unifi Dream Wall Firmware Version <= 5.1.15
   Ui ≫ Unifi Dream Wall Version -
Ui ≫ Unifi Dream Router 7 Firmware Version <= 5.1.15
   Ui ≫ Unifi Dream Router 7 Version -
Ui ≫ Unifi Express 7 Firmware Version <= 5.1.15
   Ui ≫ Unifi Express 7 Version -
Ui ≫ Unifi Cloudkey Firmware Version <= 5.1.15
   Ui ≫ Unifi Cloudkey Version -
Ui ≫ Unifi Cloud Key Plus Firmware Version <= 5.1.15
   Ui ≫ Unifi Cloud Key Plus Version -
Ui ≫ Unifi Cloudkey Enterprise Firmware Version <= 5.1.15
   Ui ≫ Unifi Cloudkey Enterprise Version -
Ui ≫ Unifi Network Video Recorder Firmware Version <= 5.1.15
   Ui ≫ Unifi Network Video Recorder Version -
Ui ≫ Unifi Cloud Gateway Ultra Firmware Version <= 5.1.15
   Ui ≫ Unifi Cloud Gateway Ultra Version -
Ui ≫ Unifi Cloud Gateway Max Firmware Version <= 5.1.15
   Ui ≫ Unifi Cloud Gateway Max Version -
Ui ≫ Unifi Cloud Gateway Fiber Firmware Version <= 5.1.15
   Ui ≫ Unifi Cloud Gateway Fiber Version -
Ui ≫ Unas 2 Firmware Version <= 5.1.16
   Ui ≫ Unas 2 Version -
Ui ≫ Unas 4 Firmware Version <= 5.1.16
   Ui ≫ Unas 4 Version -
Ui ≫ Unas Pro Firmware Version <= 5.1.16
   Ui ≫ Unas Pro Version -
Ui ≫ Unas Pro 4 Firmware Version <= 5.1.16
   Ui ≫ Unas Pro 4 Version -
Ui ≫ Unas Pro 8 Firmware Version <= 5.1.16
   Ui ≫ Unas Pro 8 Version -
Ui ≫ Enterprise Firewall Core Firmware Version <= 5.1.18
   Ui ≫ Enterprise Firewall Core Version -
Ui ≫ Unifi Dream Router 5g Max Firmware Version <= 5.1.15
   Ui ≫ Unifi Dream Router 5g Max Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.151
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
HackerOne 7.7 3.1 4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc
Vendor Advisory