Read the docs
TI-2026-35956 Aliases CVE-2026-48610GHSA-x48g-g9fg-6pfc

Improper access control in Ubiquiti UDM

Priority LOW 37CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00264 18th percentileScored 2026-11-07
Fix Fixed UDM (Ubiquiti Inc): 5.1.15UDM-Pro (Ubiquiti Inc): 5.1.15+13 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UbiquitiUDMbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDM-Probefore 5.1.155.1.15Patch availableCNA
UbiquitiUDM-SEbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDM-Pro-Maxbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDM-Beastbefore 5.1.155.1.15Patch availableCNA
UbiquitiEFGbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDWbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDRbefore 5.1.155.1.15Patch availableCNA
UbiquitiUDR7before 5.1.155.1.15Patch availableCNA
UbiquitiUDR-5Gbefore 5.1.155.1.15Patch availableCNA
UbiquitiExpress 7before 5.1.155.1.15Patch availableCNA
UbiquitiUCG-Ultrabefore 5.1.155.1.15Patch availableCNA
UbiquitiUCG-Maxbefore 5.1.155.1.15Patch availableCNA
UbiquitiUCG-Fiberbefore 5.1.155.1.15Patch availableCNA
UbiquitiUCG-Industrialbefore 5.1.155.1.15Patch availableCNA
  • UDM VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDM-Pro VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDM-SE VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDM-Pro-Max VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDM-Beast VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • EFG VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDW VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDR VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDR7 VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UDR-5G VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • Express 7 VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UCG-Ultra VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UCG-Max VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UCG-Fiber VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA
  • UCG-Industrial VendorUbiquiti Affected before 5.1.15 Fixed in 5.1.15 Patch available CNA

Remediation

  • Fix · CNA UDM (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDM-Pro (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDM-SE (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDM-Pro-Max (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDM-Beast (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA EFG (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDW (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDR (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDR7 (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UDR-5G (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA Express 7 (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UCG-Ultra (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UCG-Max (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UCG-Fiber (Ubiquiti Inc) Fixed in 5.1.15
  • Fix · CNA UCG-Industrial (Ubiquiti Inc) Fixed in 5.1.15

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Ubiquiti EFG, Express 7 and 13 more products 5.1.15

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-34942 Improper input validation in Ubiquiti UniFi OS ServerPriority MEDIUM 44
    • TI-2026-34941 Improper input validation in Ubiquiti UniFi OS ServerPriority MEDIUM 43
    • TI-2026-34940 Path traversal in Ubiquiti UniFi OS ServerPriority LOW 37
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48610
  2. 2026-10-03 Alias added: GHSA-x48g-g9fg-6pfc

References

Other 1

  • TI-2026-27142 Improper input validation in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-27141 Path traversal in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-27140 Improper access control in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2010-05027 On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-19187 AirControl 1.4.2 - PreAuth Remote Code Execution CVSS 4.0CRITICAL 9.3
  • TI-2015-07644 Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload CVSS 3.0CRITICAL 9.8
See all 206 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences