8.8

CVE-2026-54402

Medienbericht
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ui ≫ Unifi Os Server Version <= 5.1.15
Ui ≫ Unifi Dream Machine Firmware Version <= 5.1.15
   Ui ≫ Unifi Dream Machine Version -
Ui ≫ Unifi Dream Machine Pro Firmware Version <= 5.1.15
   Ui ≫ Unifi Dream Machine Pro Version -
Ui ≫ Unifi Dream Machine Pro Max Firmware Version <= 5.1.15
   Ui ≫ Unifi Dream Machine Pro Max Version -
Ui ≫ Unifi Dream Machine Beast Firmware Version <= 5.1.15
   Ui ≫ Unifi Dream Machine Beast Version -
Ui ≫ Enterprise Fortress Gateway Firmware Version <= 5.1.15
   Ui ≫ Enterprise Fortress Gateway Version -
Ui ≫ Unifi Dream Router Firmware Version <= 5.1.15
   Ui ≫ Unifi Dream Router Version -
Ui ≫ Unifi Dream Wall Firmware Version <= 5.1.15
   Ui ≫ Unifi Dream Wall Version -
Ui ≫ Unifi Dream Router 7 Firmware Version <= 5.1.15
   Ui ≫ Unifi Dream Router 7 Version -
Ui ≫ Unifi Express 7 Firmware Version <= 5.1.15
   Ui ≫ Unifi Express 7 Version -
Ui ≫ Unifi Cloudkey Firmware Version <= 5.1.15
   Ui ≫ Unifi Cloudkey Version -
Ui ≫ Unifi Cloud Key Plus Firmware Version <= 5.1.15
   Ui ≫ Unifi Cloud Key Plus Version -
Ui ≫ Unifi Cloudkey Enterprise Firmware Version <= 5.1.15
   Ui ≫ Unifi Cloudkey Enterprise Version -
Ui ≫ Unifi Network Video Recorder Firmware Version <= 5.1.15
   Ui ≫ Unifi Network Video Recorder Version -
Ui ≫ Unifi Cloud Gateway Ultra Firmware Version <= 5.1.15
   Ui ≫ Unifi Cloud Gateway Ultra Version -
Ui ≫ Unifi Cloud Gateway Max Firmware Version <= 5.1.15
   Ui ≫ Unifi Cloud Gateway Max Version -
Ui ≫ Unifi Cloud Gateway Fiber Firmware Version <= 5.1.15
   Ui ≫ Unifi Cloud Gateway Fiber Version -
Ui ≫ Unas 2 Firmware Version <= 5.1.16
   Ui ≫ Unas 2 Version -
Ui ≫ Unas 4 Firmware Version <= 5.1.16
   Ui ≫ Unas 4 Version -
Ui ≫ Unas Pro Firmware Version <= 5.1.16
   Ui ≫ Unas Pro Version -
Ui ≫ Unas Pro 4 Firmware Version <= 5.1.16
   Ui ≫ Unas Pro 4 Version -
Ui ≫ Unas Pro 8 Firmware Version <= 5.1.16
   Ui ≫ Unas Pro 8 Version -
Ui ≫ Enterprise Firewall Core Firmware Version <= 5.1.18
   Ui ≫ Enterprise Firewall Core Version -
Ui ≫ Unifi Dream Router 5g Max Firmware Version <= 5.1.15
   Ui ≫ Unifi Dream Router 5g Max Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.31% 0.677
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
HackerOne 9.9 3.1 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
13.07.2026 17:25
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
08.07.2026 17:04
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
08.07.2026 10:19
https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc
Vendor Advisory