CVE-2026-34910

Overview

This vulnerability is a command injection flaw resulting from improper input validation in UniFi OS Server and related UniFi firmware components. The root cause lies in the failure to sanitize user-supplied input before passing it to system-level command execution functions. Affected components include UniFi OS Server and multiple UniFi device firmware versions, where network-accessible interfaces process untrusted input without adequate validation.

Vulnerability Description

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

Impact

An unauthenticated attacker with network access can execute arbitrary system commands on affected UniFi devices, resulting in full system compromise. This enables unauthorized control over device operations, potential data exfiltration, lateral movement within the network, and disruption of network services. The attack requires no user interaction or valid credentials, making it highly exploitable in exposed network environments.

Solution

Ubiquiti has released Security Advisory Bulletin 064 addressing this issue for UniFi OS Server and related firmware. Administrators should apply the latest firmware updates as specified in the advisory available at https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b. The advisory provides detailed patch versions and upgrade instructions for affected UniFi devices to mitigate this vulnerability.

Affected Products (31)

	Vendor	Product	Version	CPE
U	Ui	Unifi Os Server	All	cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:*
U	Ui	Enterprise Fortress Gateway Firmware	All	cpe:2.3:o:ui:enterprise_fortress_gateway_firmware:*:*:*:*:*:*:*:*
U	Ui	Enterprise Network Video Recorder Core Firmware	All	cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:*
U	Ui	Enterprise Network Video Recorder Firmware	All	cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:*
U	Ui	Unas 2 Firmware	All	cpe:2.3:o:ui:unas_2_firmware:*:*:*:*:*:*:*:*
U	Ui	Unas 4 Firmware	All	cpe:2.3:o:ui:unas_4_firmware:*:*:*:*:*:*:*:*
U	Ui	Unas Pro 4 Firmware	All	cpe:2.3:o:ui:unas_pro_4_firmware:*:*:*:*:*:*:*:*
U	Ui	Unas Pro 8 Firmware	All	cpe:2.3:o:ui:unas_pro_8_firmware:*:*:*:*:*:*:*:*
U	Ui	Unas Pro Firmware	All	cpe:2.3:o:ui:unas_pro_firmware:*:*:*:*:*:*:*:*
U	Ui	Unifi Cloud Gateway Fiber Firmware	All	cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:*
U	Ui	Unifi Cloud Gateway Industrial Firmware	All	cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:*
U	Ui	Unifi Cloud Gateway Max Firmware	All	cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:*
U	Ui	Unifi Cloud Gateway Ultra Firmware	All	cpe:2.3:o:ui:unifi_cloud_gateway_ultra_firmware:*:*:*:*:*:*:*:*
U	Ui	Unifi Cloud Key Plus Firmware	All	cpe:2.3:o:ui:unifi_cloud_key_plus_firmware:*:*:*:*:*:*:*:*
U	Ui	Unifi Cloudkey Enterprise Firmware	All	cpe:2.3:o:ui:unifi_cloudkey_enterprise_firmware:*:*:*:*:*:*:*:*
U	Ui	Unifi Cloudkey Firmware	All	cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:*
U	Ui	Unifi Dream Machine Beast Firmware	All	cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:*
U	Ui	Unifi Dream Machine Firmware	All	cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:*
U	Ui	Unifi Dream Machine Pro Firmware	All	cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:*
U	Ui	Unifi Dream Machine Pro Max Firmware	All	cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:*

+11 additional CPEs

GitHub PoCs (2)

Attack Vectors ML

MITRE ATT&CK Techniques (0)

CAPEC Attack Patterns ML

Red Team Playbook

Detection & Response Rules

No detection or response rules found for this CVE.

No news articles found for this CVE.

References (4)