Vulnerability-Lookup

CVE-2026-54402 (GCVE-0-2026-54402)

Vulnerability from cvelistv5 – Published: 2026-07-02 14:49 – Updated: 2026-07-02 15:52

Summary

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-20 - Improper Input Validation

Assigner

hackerone

References

1 reference

URL	Tags
https://community.ui.com/releases/Security-Adviso…

Impacted products

12 products

Vendor	Product	Version
Ubiquiti Inc	UniFi OS Server	Affected: 0 , < 5.1.19 (semver)
Ubiquiti Inc	Dream Machines	Affected: 0 , < 5.1.19 (semver)
Ubiquiti Inc	Enterprise Fortress Gateway	Affected: 0 , < 5.1.19 (semver)
Ubiquiti Inc	Dream Wall	Affected: 0 , < 5.1.19 (semver)
Ubiquiti Inc	Dream Routers	Affected: 0 , < 5.1.19 (semver)
Ubiquiti Inc	Express 7	Affected: 0 , < 5.1.19 (semver)
Ubiquiti Inc	Cloud Keys	Affected: 0 , < 5.1.19 (semver)
Ubiquiti Inc	Network Video Recorders	Affected: 0 , < 5.1.19 (semver)
Ubiquiti Inc	Enterprise Video Recorders	Affected: 0 , < 5.1.19 (semver)
Ubiquiti Inc	Cloud Gateways	Affected: 0 , < 5.1.19 (semver)
Ubiquiti Inc	Network Attached Storage	Affected: 0 , < 5.1.19 (semver)
Ubiquiti Inc	Enterprise Firewall Core	Affected: 0 , < 5.1.19 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54402",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-02T15:41:31.917927Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-02T15:52:04.606Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "UniFi OS Server",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Dream Machines",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Enterprise Fortress Gateway",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Dream Wall",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Dream Routers",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Express 7",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cloud Keys",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Network Video Recorders",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Enterprise Video Recorders",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cloud Gateways",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Network Attached Storage",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Enterprise Firewall Core",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-02T14:49:17.030Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-54402",
    "datePublished": "2026-07-02T14:49:17.030Z",
    "dateReserved": "2026-06-13T15:00:00.604Z",
    "dateUpdated": "2026-07-02T15:52:04.606Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54402\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2026-07-02T15:17:03.837\",\"lastModified\":\"2026-07-02T16:54:47.880\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.\"}],\"affected\":[{\"source\":\"support@hackerone.com\",\"affectedData\":[{\"vendor\":\"Ubiquiti Inc\",\"product\":\"UniFi OS Server\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.1.19\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Ubiquiti Inc\",\"product\":\"Dream Machines\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.1.19\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Ubiquiti Inc\",\"product\":\"Enterprise Fortress Gateway\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.1.19\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Ubiquiti Inc\",\"product\":\"Dream Wall\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.1.19\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Ubiquiti Inc\",\"product\":\"Dream Routers\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.1.19\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Ubiquiti Inc\",\"product\":\"Express 7\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.1.19\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Ubiquiti Inc\",\"product\":\"Cloud Keys\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.1.19\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Ubiquiti Inc\",\"product\":\"Network Video Recorders\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.1.19\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Ubiquiti Inc\",\"product\":\"Enterprise Video Recorders\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.1.19\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Ubiquiti Inc\",\"product\":\"Cloud Gateways\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.1.19\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Ubiquiti Inc\",\"product\":\"Network Attached Storage\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.1.19\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Ubiquiti Inc\",\"product\":\"Enterprise Firewall Core\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.1.19\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.1,\"impactScore\":6.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-02T15:41:31.917927Z\",\"id\":\"CVE-2026-54402\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"references\":[{\"url\":\"https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc\",\"source\":\"support@hackerone.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54402\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-02T15:41:31.917927Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-02T15:41:32.941Z\"}}], \"cna\": {\"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.9, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"Ubiquiti Inc\", \"product\": \"UniFi OS Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.1.19\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Ubiquiti Inc\", \"product\": \"Dream Machines\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.1.19\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Ubiquiti Inc\", \"product\": \"Enterprise Fortress Gateway\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.1.19\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Ubiquiti Inc\", \"product\": \"Dream Wall\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.1.19\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Ubiquiti Inc\", \"product\": \"Dream Routers\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.1.19\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Ubiquiti Inc\", \"product\": \"Express 7\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.1.19\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Ubiquiti Inc\", \"product\": \"Cloud Keys\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.1.19\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Ubiquiti Inc\", \"product\": \"Network Video Recorders\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.1.19\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Ubiquiti Inc\", \"product\": \"Enterprise Video Recorders\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.1.19\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Ubiquiti Inc\", \"product\": \"Cloud Gateways\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.1.19\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Ubiquiti Inc\", \"product\": \"Network Attached Storage\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.1.19\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Ubiquiti Inc\", \"product\": \"Enterprise Firewall Core\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.1.19\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"36234546-b8fa-4601-9d6f-f4e334aa8ea1\", \"shortName\": \"hackerone\", \"dateUpdated\": \"2026-07-02T14:49:17.030Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54402\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-02T15:52:04.606Z\", \"dateReserved\": \"2026-06-13T15:00:00.604Z\", \"assignerOrgId\": \"36234546-b8fa-4601-9d6f-f4e334aa8ea1\", \"datePublished\": \"2026-07-02T14:49:17.030Z\", \"assignerShortName\": \"hackerone\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54402

Vulnerability from fkie_nvd - Published: 2026-07-02 15:17 - Updated: 2026-07-02 16:54

Severity

9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.

References

	URL	Tags
	support@hackerone.com	https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "UniFi OS Server",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Dream Machines",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Enterprise Fortress Gateway",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Dream Wall",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Dream Routers",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Express 7",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cloud Keys",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Network Video Recorders",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Enterprise Video Recorders",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cloud Gateways",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Network Attached Storage",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Enterprise Firewall Core",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "5.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "support@hackerone.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device."
    }
  ],
  "id": "CVE-2026-54402",
  "lastModified": "2026-07-02T16:54:47.880",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "support@hackerone.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54402",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-02T15:41:31.917927Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-02T15:17:03.837",
  "references": [
    {
      "source": "support@hackerone.com",
      "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc"
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "support@hackerone.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GHGX-H467-6R25

Vulnerability from github – Published: 2026-07-02 15:32 – Updated: 2026-07-02 15:32

Details

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.

Severity

9.9 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-54402"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-02T15:17:03Z",
    "severity": "CRITICAL"
  },
  "details": "A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.",
  "id": "GHSA-ghgx-h467-6r25",
  "modified": "2026-07-02T15:32:12Z",
  "published": "2026-07-02T15:32:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54402"
    },
    {
      "type": "WEB",
      "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2026-2171

Vulnerability from csaf_certbund - Published: 2026-07-01 22:00 - Updated: 2026-07-02 22:00

Summary

Ubiquiti UniFi: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: UniFi ist Ubiquiti's End-to-End-Netzwerk-Ökosystem für Unternehmen und Smart Homes.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Ubiquiti UniFi ausnutzen, um beliebigen Programmcode auszuführen, um einen SQL-Injection Angriff durchzuführen, um seine Privilegien zu erhöhen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Daten zu manipulieren, und um Informationen offenzulegen.

Betroffene Betriebssysteme: - Sonstiges

CVE-2026-50746

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-50747

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-50748

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-54400

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-54401

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-54402

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-54403

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-54404

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-54405

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-54406

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-54407

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-54408

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-54409

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-55110

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-55111

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-55112

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-55113

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-55114

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-55115

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-55116

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-55117

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-55118

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-55119

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-56841

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

CVE-2026-56842

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Ubiquiti UniFi Ubiquiti	`cpe:/a:ubnt:unifi:-`	—

References

3 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://community.ui.com/releases/Security-Adviso…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "UniFi ist Ubiquiti\u0027s End-to-End-Netzwerk-\u00d6kosystem f\u00fcr Unternehmen und Smart Homes.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Ubiquiti UniFi ausnutzen, um beliebigen Programmcode auszuf\u00fchren, um einen SQL-Injection Angriff durchzuf\u00fchren, um seine Privilegien zu erh\u00f6hen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuf\u00fchren, um Daten zu manipulieren, und um Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2171 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2171.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2171 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2171"
      },
      {
        "category": "external",
        "summary": "Security Advisory Bulletin vom 2026-07-01",
        "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc"
      }
    ],
    "source_lang": "en-US",
    "title": "Ubiquiti UniFi: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-07-02T22:00:00.000+00:00",
      "generator": {
        "date": "2026-07-03T06:50:55.249+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2171",
      "initial_release_date": "2026-07-01T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-07-01T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-07-02T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-41401, EUVD-2026-41403, EUVD-2026-41402, EUVD-2026-41394, EUVD-2026-41395, EUVD-2026-41396, EUVD-2026-41397, EUVD-2026-41398, EUVD-2026-41399, EUVD-2026-41390, EUVD-2026-41391, EUVD-2026-41392, EUVD-2026-41393, EUVD-2026-41379, EUVD-2026-41380, EUVD-2026-41381, EUVD-2026-41382, EUVD-2026-41384, EUVD-2026-41385, EUVD-2026-41386, EUVD-2026-41388, EUVD-2026-41387, EUVD-2026-41389, EUVD-2026-41400, EUVD-2026-41383"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubiquiti UniFi",
            "product": {
              "name": "Ubiquiti UniFi",
              "product_id": "T056075",
              "product_identification_helper": {
                "cpe": "cpe:/a:ubnt:unifi:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubiquiti"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-50746",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-50746"
    },
    {
      "cve": "CVE-2026-50747",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-50747"
    },
    {
      "cve": "CVE-2026-50748",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-50748"
    },
    {
      "cve": "CVE-2026-54400",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-54400"
    },
    {
      "cve": "CVE-2026-54401",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-54401"
    },
    {
      "cve": "CVE-2026-54402",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-54402"
    },
    {
      "cve": "CVE-2026-54403",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-54403"
    },
    {
      "cve": "CVE-2026-54404",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-54404"
    },
    {
      "cve": "CVE-2026-54405",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-54405"
    },
    {
      "cve": "CVE-2026-54406",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-54406"
    },
    {
      "cve": "CVE-2026-54407",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-54407"
    },
    {
      "cve": "CVE-2026-54408",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-54408"
    },
    {
      "cve": "CVE-2026-54409",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-54409"
    },
    {
      "cve": "CVE-2026-55110",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-55110"
    },
    {
      "cve": "CVE-2026-55111",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-55111"
    },
    {
      "cve": "CVE-2026-55112",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-55112"
    },
    {
      "cve": "CVE-2026-55113",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-55113"
    },
    {
      "cve": "CVE-2026-55114",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-55114"
    },
    {
      "cve": "CVE-2026-55115",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-55115"
    },
    {
      "cve": "CVE-2026-55116",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-55116"
    },
    {
      "cve": "CVE-2026-55117",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-55117"
    },
    {
      "cve": "CVE-2026-55118",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-55118"
    },
    {
      "cve": "CVE-2026-55119",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-55119"
    },
    {
      "cve": "CVE-2026-56841",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-56841"
    },
    {
      "cve": "CVE-2026-56842",
      "product_status": {
        "known_affected": [
          "T056075"
        ]
      },
      "release_date": "2026-07-01T22:00:00.000+00:00",
      "title": "CVE-2026-56842"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-54402 (GCVE-0-2026-54402)

FKIE_CVE-2026-54402

GHSA-GHGX-H467-6R25

WID-SEC-W-2026-2171

Tags

Sightings

Nomenclature