CVE Intelligence

Ui vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Ui products: 38 record(s), with severity, exploitation and fixes.

Unifi Cloud Gateway Industrial Firmware 10Unifi Dream Machine Beast Firmware 10Unifi Network Video Recorder G2 Pro Firmware 10Unifi Network Video Recorder G2 Firmware 10Unifi Cloudkey Firmware 10Enterprise Network Video Recorder Core Firmware 10Unifi Cloud Gateway Fiber Firmware 10Unifi Cloud Gateway Max Firmware 10Enterprise Network Video Recorder Firmware 10Unifi Network Video Recorder Instant Firmware 10Unifi Network Video Recorder Pro Firmware 10Unifi Network Video Recorder Firmware 10Unifi Dream Router 7 Firmware 10Unifi Dream Router Firmware 10Unifi Dream Wall Firmware 10Unifi Dream Machine Pro Max Firmware 10Unifi Dream Machine Special Edition Firmware 10Unifi Dream Machine Pro Firmware 10Unifi Os Server 10Unifi Express 7 Firmware 9Unas Pro 8 Firmware 9Unas Pro 4 Firmware 9Unas Pro Firmware 9Unas 4 Firmware 9Unas 2 Firmware 9Unifi Cloudkey Enterprise Firmware 9Unifi Cloud Key Plus Firmware 9Unifi Dream Router 5g Max Firmware 9Enterprise Fortress Gateway Firmware 9Unifi Cloud Gateway Ultra Firmware 9Unifi Dream Machine Firmware 8Unifi Protect 7Unifi Network Application 5Enterprise Firewall Core Firmware 5Unifi Access 4Unifi Talk Application 3Protect Floodlight Firmware 1Unifi Connect 1Unifi Connect Application 1Airfiber Af60 Firmware 1

Exploited only (KEV) →

CVE-2026-34911 High · 7.7 CWE-22 May 21, 2026
Path Traversal in Ui Unifi Os Server
A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.
CVE-2026-34908 Critical · 10.0 KEV Urgent · 73 Public exploit CWE-284 May 21, 2026
Ubiquiti UniFi OS Improper Access Control Vulnerability
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
CVE-2026-34909 Critical · 10.0 KEV High · 60 CWE-22 May 21, 2026
Ubiquiti UniFi OS Path Traversal Vulnerability
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.
CVE-2026-34910 Critical · 10.0 KEV Urgent · 73 Public exploit CWE-20 May 21, 2026
Ubiquiti UniFi OS Improper Input Validation Vulnerability
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
CVE-2026-33000 Critical · 9.1 CWE-20 May 21, 2026
Improper Input Validation in Ui Unifi Os Server
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
CVE-2026-21639 High · 8.8 CWE-120 Jan 8, 2026
Classic Buffer Overflow in Ui Airmax Ac Firmware
A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.
CVE-2026-21638 High · 8.8 CWE-77 Jan 8, 2026
Command Injection in Ui Ubb-xg Firmware
A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product. Affected Products: UBB-XG (Version 1.2.2 and earlier) UDB-Pro/UDB-Pro-Sector (Version 1.4.1 and earlier) UBB (Version 3.1.5 and earlier) Mitigation: Update your UBB-XG to Version 1.2.3 or later. Update your UDB-Pro/UDB-Pro-Sector to Version 1.4.2 or later. Update your UBB to Version 3.1.7 or later.
CVE-2026-21635 Medium · 6.5 CWE-284 Jan 5, 2026
Improper Access Control in Ui Unifi Connect Ev Station Lite Firmware
An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink feature on a device that was only adopted via Ethernet.
CVE-2026-21634 Medium · 6.5 CWE-119 Jan 5, 2026
Buffer Errors (Improper Restriction of Operations within Memory Bounds) in Ui Unifi Protect
A malicious actor with access to the adjacent network could overflow the UniFi Protect Application (Version 6.1.79 and earlier) discovery protocol causing it to restart. Affected Products: UniFi Protect Application (Version 6.1.79 and earlier). Mitigation: Update your UniFi Protect Application to Version 6.2.72 or later.
CVE-2026-21633 High · 8.8 CWE-287 Jan 5, 2026
Improper Authentication in Ui Unifi Protect
A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerability in the Unifi Protect Application (Version 6.1.79 and earlier). Affected Products: UniFi Protect Application (Version 6.1.79 and earlier). Mitigation: Update your UniFi Protect Application to Version 6.2.72 or later.
CVE-2025-59467 Critical · 9.6 CWE-79 Jan 5, 2026
Cross-site Scripting (XSS) in Ui Argentina Afip Invoices
A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. This plugin is disabled by default. Affected Products: UCRM Argentina AFIP invoices Plugin (Version 1.2.0 and earlier) Mitigation: Update UCRM Argentina AFIP invoices Plugin to Version 1.3.0 or later.
CVE-2025-52665 Critical · 10.0 Public exploit CWE-306 Oct 30, 2025
Missing Authentication for Critical Function in Ui Unifi Access
A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later.  Affected Products: UniFi Access Application (Version 3.3.22 through 3.4.31). 
 Mitigation: Update your UniFi Access Application to Version 4.0.21 or later.
CVE-2010-5330 Critical · 9.8 KEV High · 63 CWE-77 Jun 11, 2019
Ubiquiti AirOS Command Injection Vulnerability
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.