Summary
A malicious actor with access to the network could exploit an improper access control vulnerability in UniFi OS devices to make unauthorized changes to the system. Ubiquiti says the issue affects multiple UniFi OS device families and UniFi OS Server, with fixes released in Security Advisory Bulletin 064. In practice, an attacker could alter device settings and other administrative state without proper authorization.
Why Planned Fix?
4/6No authentication required
Internal deployment
No user interaction needed
Exploitable in default configuration
No active exploitation or PoC
High impact vulnerability
Exploitation Details
Type
Authentication Bypass
Is exploitable with default configuration?
Yes
Is authentication needed?
No
PoC / Exploit
No
Impact
Make unauthorized changes to device configuration and system state.
Data ManipulationExploitation Requirements
Exploitation Process
Detection Resources
Manual Detection
0
Script Detection
0
Scanner Detection
0
Affected Software
Vendor:Ubiquiti
| Product | Affected Versions |
|---|---|
| UCG-Industrial | 5.0.13 and earlier |
| UDM | 5.0.16 and earlier |
| UDM-Pro | 5.0.16 and earlier |
| UDM-SE | 5.0.16 and earlier |
| UDM-Pro-Max | 5.0.16 and earlier |
| EFG | 5.0.16 and earlier |
| UDW | 5.0.16 and earlier |
| UDR | 5.0.16 and earlier |
| UDR7 | 5.0.16 and earlier |
| Express 7 | 5.0.16 and earlier |
| UNVR | 5.0.16 and earlier |
| UNVR-Pro | 5.0.16 and earlier |
| UNVR-Instant | 5.0.16 and earlier |
| ENVR | 5.0.16 and earlier |
| UCG-Ultra | 5.0.16 and earlier |
| UCG-Max | 5.0.16 and earlier |
| UCG-Fiber | 5.0.16 and earlier |
| UDR-5G | 5.0.17 and earlier |
| ENVR-Core | 5.0.17 and earlier |
| UCKP | 5.0.17 and earlier |
| UCK | 5.0.17 and earlier |
| UCK-Enterprise | 5.0.17 and earlier |
| UniFi OS Server | 5.0.6 and earlier |
| UNVR-G2 | 5.1.11 and earlier |
| UNVR-G2-Pro | 5.1.11 and earlier |
| UDM-Beast | 5.1.8 and earlier |
| UNAS-2 | 5.1.8 and earlier |
| UNAS-4 | 5.1.8 and earlier |
| UNAS-Pro | 5.1.8 and earlier |
| UNAS-Pro-4 | 5.1.8 and earlier |
| UNAS-Pro-8 | 5.1.8 and earlier |
Description
Operating system and management platform for UniFi consoles and appliances used to administer networking, storage, and video/security services.
Deployment:Typically internal
|Protocol:HTTPS
|Ports:443
Affected ComponentNetwork-accessible administrative authorization checks in the UniFi OS management interface.
Network-accessible administrative authorization checks in the UniFi OS management interface.
Enterprise UsageEstimated likelihood that this vendor/product is deployed in enterprise environments. AI-generated estimation based on market presence, product type and adoption signals — not exact data.
Very Low
Low
Medium
High
Very High
Vendor Size:Medium
Vendor Notifications
https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963bhttps://community.ui.com/releases/UniFi-OS-Server-5-0-8/6b00e638-d383-4767-b886-fde29f5e331bhttps://community.ui.com/releases/UniFi-OS-Cloud-Gateways-5-1-12/41549e59-0a2f-4ee9-8450-dee7ec15a58dhttps://community.ui.com/releases/UniFi-OS-Dream-Routers-5-1-12/4f165cc3-22ab-4144-916d-3c4da7afee3bhttps://community.ui.com/releases/UniFi-OS-Express-7-5-1-12/abe29aaa-2851-4247-9a92-076a4a467841https://community.ui.com/releases/UniFi-OS-Network-Attached-Storage-5-1-10/6a999e8b-0985-403b-b865-8f3ad63eb60ehttps://community.ui.com/releases/UniFi-OS-Enterprise-Network-Video-Recorders-5-1-12/e01ca704-079d-40ec-81d0-a36ecfa1f277https://community.ui.com/releases/UniFi-OS-Network-Video-Recorders-5-1-12/c3b995a8-3bea-4830-a265-50f077ed9f7fhttps://community.ui.com/releases/UniFi-OS-Cloud-Keys-5-1-12/b8c2c586-be95-44e1-921c-26201f1838eahttps://community.ui.com/releases/UniFi-OS-Enterprise-Fortress-Gateway-5-1-12/9427e825-b0c9-487d-b2a9-5cbb393f219ahttps://community.ui.com/releases/UniFi-OS-Dream-Machines-5-1-12/6a229a80-ed47-4509-a9a3-046122ecc1b9https://community.ui.com/releases/UniFi-OS-Dream-Machine-Beast-5-1-11/12eae3e2-94b5-4efe-81d8-e5881721fb22https://community.ui.com/releases/UniFi-OS-Dream-Wall-5-1-12/e2fc2a8c-7546-4e7a-b545-5cabb1f5570f
Remediation
Workaround
Not available
Patch
Not available
Update
Update affected UniFi OS devices to the Security Advisory Bulletin 064 fixed releases: 5.1.12 for most console families, 5.1.10 for UniFi OS Network Attached Storage, 5.1.11 for UDM-Beast, and 5.0.8 for UniFi OS Server.
Update affected UniFi OS devices to the Security Advisory Bulletin 064 fixed releases: 5.1.12 for most console families, 5.1.10 for UniFi OS Network Attached Storage, 5.1.11 for UDM-Beast, and 5.0.8 for UniFi OS Server.
Threat Intelligence
EPSS data unavailable
CISA KEV
Not Listed
Active Exploitation
No Evidence
Threat Actors
No known threat actors
Detection Rules
No detection rules available
NVD Data
Published: Loading...Modified: Loading...
Description Summary
CVSS Base Score
10.0
Critical
CVSS Vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Attack Vector (AV)
Physical
Local
Adjacent
Network
Attack Complexity (AC)
High
Low
Privileges Required (PR)
High
Low
None
User Interaction (UI)
Required
None
Scope (S)
Unchanged
Changed
Confidentiality (C)
None
Low
High
Integrity (I)
None
Low
High
Availability (A)
None
Low
High
Sources
| Source | Article |
|---|---|
| community.ui.com | Security Advisory Bulletin 064 |
| community.ui.com | UniFi OS Server 5.0.8 |
| community.ui.com | UniFi OS Cloud Gateways 5.1.12 |
| community.ui.com | UniFi OS Dream Routers 5.1.12 |
| community.ui.com | UniFi OS Express 7 5.1.12 |
| community.ui.com | UniFi OS Network Attached Storage 5.1.10 |
| community.ui.com | UniFi OS Enterprise Network Video Recorders 5.1.12 |
| community.ui.com | UniFi OS Network Video Recorders 5.1.12 |
| community.ui.com | UniFi OS Cloud Keys 5.1.12 |
| community.ui.com | UniFi OS Enterprise Fortress Gateway 5.1.12 |
| community.ui.com | UniFi OS Dream Machines 5.1.12 |
| community.ui.com | UniFi OS Dream Machine Beast 5.1.11 |
| community.ui.com | UniFi OS Dream Wall 5.1.12 |
Priority History
Planned FixLoading...
Initial analysis