Vulnerabilidades de Ui
CVEs publicadas que afetam produtos de Ui: 38 registro(s), com severidade, exploração e correções.
Unifi Cloud Gateway Industrial Firmware 10Unifi Dream Machine Beast Firmware 10Unifi Network Video Recorder G2 Pro Firmware 10Unifi Network Video Recorder G2 Firmware 10Unifi Cloudkey Firmware 10Enterprise Network Video Recorder Core Firmware 10Unifi Cloud Gateway Fiber Firmware 10Unifi Cloud Gateway Max Firmware 10Enterprise Network Video Recorder Firmware 10Unifi Network Video Recorder Instant Firmware 10Unifi Network Video Recorder Pro Firmware 10Unifi Network Video Recorder Firmware 10Unifi Dream Router 7 Firmware 10Unifi Dream Router Firmware 10Unifi Dream Wall Firmware 10Unifi Dream Machine Pro Max Firmware 10Unifi Dream Machine Special Edition Firmware 10Unifi Dream Machine Pro Firmware 10Unifi Os Server 10Unifi Express 7 Firmware 9Unas Pro 8 Firmware 9Unas Pro 4 Firmware 9Unas Pro Firmware 9Unas 4 Firmware 9Unas 2 Firmware 9Unifi Cloudkey Enterprise Firmware 9Unifi Cloud Key Plus Firmware 9Unifi Dream Router 5g Max Firmware 9Enterprise Fortress Gateway Firmware 9Unifi Cloud Gateway Ultra Firmware 9Unifi Dream Machine Firmware 8Unifi Protect 7Unifi Network Application 5Enterprise Firewall Core Firmware 5Unifi Access 4Unifi Talk Application 3Protect Floodlight Firmware 1Unifi Connect 1Unifi Connect Application 1Airfiber Af60 Firmware 1
CVE-2026-34911
Alta · 7.7
CWE-22 21/05/2026
Path Traversal em Ui Unifi Os Server
A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.
CVE-2026-34908
Crítica · 10.0
KEV Urgente · 73 Exploit público CWE-284 21/05/2026
Ubiquiti UniFi OS Improper Access Control Vulnerability
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
CVE-2026-34909
Crítica · 10.0
KEV Alta · 60 CWE-22 21/05/2026
Ubiquiti UniFi OS Path Traversal Vulnerability
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.
CVE-2026-34910
Crítica · 10.0
KEV Urgente · 73 Exploit público CWE-20 21/05/2026
Ubiquiti UniFi OS Improper Input Validation Vulnerability
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
CVE-2026-33000
Crítica · 9.1
CWE-20 21/05/2026
Improper Input Validation em Ui Unifi Os Server
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
CVE-2026-21639
Alta · 8.8
CWE-120 08/01/2026
Classic Buffer Overflow em Ui Airmax Ac Firmware
A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.
CVE-2026-21638
Alta · 8.8
CWE-77 08/01/2026
Command Injection em Ui Ubb-xg Firmware
A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.
Affected Products:
UBB-XG (Version 1.2.2 and earlier)
UDB-Pro/UDB-Pro-Sector (Version 1.4.1 and earlier)
UBB (Version 3.1.5 and earlier)
Mitigation:
Update your UBB-XG to Version 1.2.3 or later.
Update your UDB-Pro/UDB-Pro-Sector to Version 1.4.2 or later.
Update your UBB to Version 3.1.7 or later.
CVE-2026-21635
Média · 6.5
CWE-284 05/01/2026
Improper Access Control em Ui Unifi Connect Ev Station Lite Firmware
An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink feature on a device that was only adopted via Ethernet.
CVE-2026-21634
Média · 6.5
CWE-119 05/01/2026
Buffer Errors (Improper Restriction of Operations within Memory Bounds) em Ui Unifi Protect
A malicious actor with access to the adjacent network could overflow the UniFi Protect Application (Version 6.1.79 and earlier) discovery protocol causing it to restart.
Affected Products:
UniFi Protect Application (Version 6.1.79 and earlier).
Mitigation:
Update your UniFi Protect Application to Version 6.2.72 or later.
CVE-2026-21633
Alta · 8.8
CWE-287 05/01/2026
Improper Authentication em Ui Unifi Protect
A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerability in the Unifi Protect Application (Version 6.1.79 and earlier).
Affected Products:
UniFi Protect Application (Version 6.1.79 and earlier).
Mitigation:
Update your UniFi Protect Application to Version 6.2.72 or later.
CVE-2025-59467
Crítica · 9.6
CWE-79 05/01/2026
Cross-site Scripting (XSS) em Ui Argentina Afip Invoices
A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page.
This plugin is disabled by default.
Affected Products:
UCRM Argentina AFIP invoices Plugin (Version 1.2.0 and earlier)
Mitigation:
Update UCRM Argentina AFIP invoices Plugin to Version 1.3.0 or later.
CVE-2025-52665
Crítica · 10.0
Exploit público CWE-306 30/10/2025
Missing Authentication for Critical Function em Ui Unifi Access
A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later.
Affected Products:
UniFi Access Application (Version 3.3.22 through 3.4.31).
Mitigation:
Update your UniFi Access Application to Version 4.0.21 or later.
CVE-2010-5330
Crítica · 9.8
KEV Alta · 63 CWE-77 11/06/2019
Ubiquiti AirOS Command Injection Vulnerability
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.