Path traversal in Ubiquiti UniFi OS Server
Priority LOW 35CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0068 52nd percentileScored 2026-11-07
Fix Fixed UniFi OS Server (Ubiquiti Inc): 5.0.8UDM (Ubiquiti Inc): 5.1.12+29 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ubiquiti | UniFi OS Server | before 5.0.8 | 5.0.8 | Patch available | CNA |
| Ubiquiti | UDM | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDM-Pro | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDM-SE | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDM-Pro-Max | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDM-Beast | before 5.1.11 | 5.1.11 | Patch available | CNA |
| Ubiquiti | EFG | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDW | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDR | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDR7 | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UDR-5G | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | Express 7 | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNVR | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNVR-Pro | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNVR-Instant | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNVR-G2 | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNVR-G2-Pro | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | ENVR | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | ENVR-Core | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UNAS-2 | before 5.1.10 | 5.1.10 | Patch available | CNA |
| Ubiquiti | UNAS-4 | before 5.1.10 | 5.1.10 | Patch available | CNA |
| Ubiquiti | UNAS-Pro | before 5.1.10 | 5.1.10 | Patch available | CNA |
| Ubiquiti | UNAS-Pro-4 | before 5.1.10 | 5.1.10 | Patch available | CNA |
| Ubiquiti | UNAS-Pro-8 | before 5.1.10 | 5.1.10 | Patch available | CNA |
| Ubiquiti | UCKP | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCK | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCK-Enterprise | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCG-Ultra | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCG-Max | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCG-Fiber | before 5.1.12 | 5.1.12 | Patch available | CNA |
| Ubiquiti | UCG-Industrial | before 5.1.12 | 5.1.12 | Patch available | CNA |
- UniFi OS Server VendorUbiquiti Affected before 5.0.8 Fixed in 5.0.8 Patch available CNA
- UDM VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDM-Pro VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDM-SE VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDM-Pro-Max VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDM-Beast VendorUbiquiti Affected before 5.1.11 Fixed in 5.1.11 Patch available CNA
- EFG VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDW VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDR VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDR7 VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UDR-5G VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- Express 7 VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNVR VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNVR-Pro VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNVR-Instant VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNVR-G2 VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNVR-G2-Pro VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- ENVR VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- ENVR-Core VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UNAS-2 VendorUbiquiti Affected before 5.1.10 Fixed in 5.1.10 Patch available CNA
- UNAS-4 VendorUbiquiti Affected before 5.1.10 Fixed in 5.1.10 Patch available CNA
- UNAS-Pro VendorUbiquiti Affected before 5.1.10 Fixed in 5.1.10 Patch available CNA
- UNAS-Pro-4 VendorUbiquiti Affected before 5.1.10 Fixed in 5.1.10 Patch available CNA
- UNAS-Pro-8 VendorUbiquiti Affected before 5.1.10 Fixed in 5.1.10 Patch available CNA
- UCKP VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCK VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCK-Enterprise VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCG-Ultra VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCG-Max VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCG-Fiber VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
- UCG-Industrial VendorUbiquiti Affected before 5.1.12 Fixed in 5.1.12 Patch available CNA
CPE configurations NVD · 61
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:* | before 5.0.8 | Vulnerable | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_gateway_industrial:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_machine:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_special_edition_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_machine_special_edition:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
- cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:* Versions before 5.0.8 Vulnerable ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_gateway_industrial:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_machine:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_special_edition_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_machine_special_edition:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
Show 51 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:ui:unifi_dream_machine_pro_max:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:enterprise_fortress_gateway_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:enterprise_fortress_gateway:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_wall_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_wall:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_router_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_router_7_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_router_7:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_express_7_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_express_7:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_pro_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_instant_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder_instant:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:enterprise_network_video_recorder:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_gateway_ultra_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_gateway_ultra:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_gateway_max:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_gateway_fiber:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_router_5g_max_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_router_5g_max:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:enterprise_network_video_recorder_core:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_key_plus_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_key_plus:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloudkey:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloudkey_enterprise_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloudkey_enterprise:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_g2_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder_g2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_g2_pro_firmware:*:*:*:*:*:*:*:* | before 5.1.12 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder_g2_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:* | before 5.1.11 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_machine_beast:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unas_2_firmware:*:*:*:*:*:*:*:* | before 5.1.10 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unas_2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unas_4_firmware:*:*:*:*:*:*:*:* | before 5.1.10 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unas_4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unas_pro_firmware:*:*:*:*:*:*:*:* | before 5.1.10 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unas_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unas_pro_4_firmware:*:*:*:*:*:*:*:* | before 5.1.10 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unas_pro_4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unas_pro_8_firmware:*:*:*:*:*:*:*:* | before 5.1.10 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unas_pro_8:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
- cpe:2.3:h:ui:unifi_dream_machine_pro_max:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:enterprise_fortress_gateway_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:enterprise_fortress_gateway:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_wall_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_wall:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_router_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_router_7_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_router_7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_express_7_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_express_7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_pro_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_instant_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder_instant:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:enterprise_network_video_recorder:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_gateway_ultra_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_gateway_ultra:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_gateway_max:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_gateway_fiber:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_router_5g_max_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_router_5g_max:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:enterprise_network_video_recorder_core:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_key_plus_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_key_plus:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloudkey:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloudkey_enterprise_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloudkey_enterprise:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_g2_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder_g2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_g2_pro_firmware:*:*:*:*:*:*:*:* Versions before 5.1.12 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder_g2_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:* Versions before 5.1.11 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_machine_beast:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unas_2_firmware:*:*:*:*:*:*:*:* Versions before 5.1.10 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unas_2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unas_4_firmware:*:*:*:*:*:*:*:* Versions before 5.1.10 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unas_4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unas_pro_firmware:*:*:*:*:*:*:*:* Versions before 5.1.10 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unas_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unas_pro_4_firmware:*:*:*:*:*:*:*:* Versions before 5.1.10 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unas_pro_4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unas_pro_8_firmware:*:*:*:*:*:*:*:* Versions before 5.1.10 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unas_pro_8:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
Remediation
- Fix · CNA UniFi OS Server (Ubiquiti Inc) Fixed in 5.0.8
- Fix · CNA UDM (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDM-Pro (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDM-SE (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDM-Pro-Max (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDM-Beast (Ubiquiti Inc) Fixed in 5.1.11
- Fix · CNA EFG (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDW (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDR (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDR7 (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UDR-5G (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA Express 7 (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNVR (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNVR-Pro (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNVR-Instant (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNVR-G2 (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNVR-G2-Pro (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA ENVR (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA ENVR-Core (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UNAS-2 (Ubiquiti Inc) Fixed in 5.1.10
- Fix · CNA UNAS-4 (Ubiquiti Inc) Fixed in 5.1.10
- Fix · CNA UNAS-Pro (Ubiquiti Inc) Fixed in 5.1.10
- Fix · CNA UNAS-Pro-4 (Ubiquiti Inc) Fixed in 5.1.10
- Fix · CNA UNAS-Pro-8 (Ubiquiti Inc) Fixed in 5.1.10
- Fix · CNA UCKP (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCK (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCK-Enterprise (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCG-Ultra (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCG-Max (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCG-Fiber (Ubiquiti Inc) Fixed in 5.1.12
- Fix · CNA UCG-Industrial (Ubiquiti Inc) Fixed in 5.1.12
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Ubiquiti UniFi OS Server 5.0.8
5 records Highest priority Priority CRITICAL 3 CRITICAL, 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-27142 Improper input validation in Ubiquiti UniFi OS ServerPriority CRITICAL 100
- TI-2026-27141 Path traversal in Ubiquiti UniFi OS ServerPriority CRITICAL 100
- TI-2026-27140 Improper access control in Ubiquiti UniFi OS ServerPriority CRITICAL 100
- Release ·
Ubiquiti EFG, ENVR and 28 more products 5.1.10, 5.1.11, 5.1.12
4 records Highest priority Priority CRITICAL 3 CRITICAL, 1 LOW
Other records, highest priority first
- TI-2026-27142 Improper input validation in Ubiquiti UniFi OS ServerPriority CRITICAL 100
- TI-2026-27141 Path traversal in Ubiquiti UniFi OS ServerPriority CRITICAL 100
- TI-2026-27140 Improper access control in Ubiquiti UniFi OS ServerPriority CRITICAL 100
Timeline
- 2026-10-02 Threatist record created from CVE-2026-34911
- 2026-10-03 Alias added: GHSA-m2r4-jq7j-hchx
- 2026-10-25 EPSS moved to the 50th–90th percentile
References
More Ubiquiti Enterprise Fortress Gateway Firmware vulnerabilities
- TI-2026-27142 Improper input validation in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
- TI-2026-27141 Path traversal in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
- TI-2026-27140 Improper access control in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
- TI-2026-39278 Improper input validation in Ubiquiti UniFi OS Server CVSS 3.1CRITICAL 9.9
- TI-2026-39279 Path traversal in Ubiquiti UniFi OS Server CVSS 3.1HIGH 8.6
- TI-2026-39280 SQL injection in Ubiquiti UniFi OS Server CVSS 3.1HIGH 8.8
Sources
- CVE-2026-34911 · CVE Program
- CVE-2026-34911 · NVD
- FIRST EPSS
- GHSA-m2r4-jq7j-hchx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences