Improper access control in Ubiquiti Dream Machines
Priority MEDIUM 40CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi OS with UniFi Protect Application to escalate privileges on the host device.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00356 29th percentileScored 2026-11-07
Fix Fixed Dream Machines (Ubiquiti Inc): 5.1.19Dream Wall (Ubiquiti Inc): 5.1.19+5 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ubiquiti | Dream Machines | before 5.1.19 | 5.1.19 | Patch available | CNA |
| Ubiquiti | Dream Wall | before 5.1.19 | 5.1.19 | Patch available | CNA |
| Ubiquiti | Dream Routers | before 5.1.19 | 5.1.19 | Patch available | CNA |
| Ubiquiti | Cloud Keys | before 5.1.19 | 5.1.19 | Patch available | CNA |
| Ubiquiti | Network Video Recorders | before 5.1.19 | 5.1.19 | Patch available | CNA |
| Ubiquiti | Enterprise Video Recorders | before 5.1.19 | 5.1.19 | Patch available | CNA |
| Ubiquiti | Cloud Gateways | before 5.1.19 | 5.1.19 | Patch available | CNA |
- Dream Machines VendorUbiquiti Affected before 5.1.19 Fixed in 5.1.19 Patch available CNA
- Dream Wall VendorUbiquiti Affected before 5.1.19 Fixed in 5.1.19 Patch available CNA
- Dream Routers VendorUbiquiti Affected before 5.1.19 Fixed in 5.1.19 Patch available CNA
- Cloud Keys VendorUbiquiti Affected before 5.1.19 Fixed in 5.1.19 Patch available CNA
- Network Video Recorders VendorUbiquiti Affected before 5.1.19 Fixed in 5.1.19 Patch available CNA
- Enterprise Video Recorders VendorUbiquiti Affected before 5.1.19 Fixed in 5.1.19 Patch available CNA
- Cloud Gateways VendorUbiquiti Affected before 5.1.19 Fixed in 5.1.19 Patch available CNA
CPE configurations NVD · 38
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_special_edition_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_machine_special_edition:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_machine_pro_max:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_machine_beast:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_router_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
- cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_special_edition_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_machine_special_edition:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_machine_pro_max:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_machine_beast:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_router_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
Show 28 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:ui:unifi_dream_wall_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_wall:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_router_7_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_router_7:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloudkey:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_pro_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_instant_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder_instant:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:enterprise_network_video_recorder:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:enterprise_network_video_recorder_core:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_g2_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder_g2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_network_video_recorder_g2_pro_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_network_video_recorder_g2_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_gateway_max:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_gateway_industrial:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_cloud_gateway_fiber:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
| cpe:2.3:o:ui:unifi_dream_router_5g_max_firmware:*:*:*:*:*:*:*:* | up to 5.1.15 | Vulnerable | Ubiquiti |
| cpe:2.3:h:ui:unifi_dream_router_5g_max:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Ubiquiti |
- cpe:2.3:o:ui:unifi_dream_wall_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_wall:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_router_7_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_router_7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloudkey:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_pro_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_instant_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder_instant:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:enterprise_network_video_recorder:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:enterprise_network_video_recorder_core:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_g2_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder_g2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_network_video_recorder_g2_pro_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_network_video_recorder_g2_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_gateway_max:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_gateway_industrial:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_cloud_gateway_fiber:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
- cpe:2.3:o:ui:unifi_dream_router_5g_max_firmware:*:*:*:*:*:*:*:* Versions up to 5.1.15 Vulnerable ·Ubiquiti
- cpe:2.3:h:ui:unifi_dream_router_5g_max:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
Remediation
- Fix · CNA Dream Machines (Ubiquiti Inc) Fixed in 5.1.19
- Fix · CNA Dream Wall (Ubiquiti Inc) Fixed in 5.1.19
- Fix · CNA Dream Routers (Ubiquiti Inc) Fixed in 5.1.19
- Fix · CNA Cloud Keys (Ubiquiti Inc) Fixed in 5.1.19
- Fix · CNA Network Video Recorders (Ubiquiti Inc) Fixed in 5.1.19
- Fix · CNA Enterprise Video Recorders (Ubiquiti Inc) Fixed in 5.1.19
- Fix · CNA Cloud Gateways (Ubiquiti Inc) Fixed in 5.1.19
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Ubiquiti Cloud Gateways, Dream Machines and 2 more products 5.1.19
7 records Highest priority Priority MEDIUM 5 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-39278 Improper input validation in Ubiquiti UniFi OS ServerPriority MEDIUM 46
- TI-2026-39279 Path traversal in Ubiquiti UniFi OS ServerPriority MEDIUM 45
- TI-2026-39814 Improper access control in Ubiquiti Dream MachinesPriority MEDIUM 43
- Release ·
Ubiquiti Cloud Keys, Enterprise Video Recorders, Network Video Recorders 5.1.19
6 records Highest priority Priority MEDIUM 4 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-39278 Improper input validation in Ubiquiti UniFi OS ServerPriority MEDIUM 46
- TI-2026-39279 Path traversal in Ubiquiti UniFi OS ServerPriority MEDIUM 45
- TI-2026-39280 SQL injection in Ubiquiti UniFi OS ServerPriority MEDIUM 41
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55112
- 2026-10-03 Alias added: GHSA-8jvx-73vq-fvch
References
More Ubiquiti Enterprise Network Video Recorder Core Firmware vulnerabilities
- TI-2026-27142 Improper input validation in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
- TI-2026-27141 Path traversal in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
- TI-2026-27140 Improper access control in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
- TI-2026-39278 Improper input validation in Ubiquiti UniFi OS Server CVSS 3.1CRITICAL 9.9
- TI-2026-39279 Path traversal in Ubiquiti UniFi OS Server CVSS 3.1HIGH 8.6
- TI-2026-39280 SQL injection in Ubiquiti UniFi OS Server CVSS 3.1HIGH 8.8
Sources
- CVE-2026-55112 · CVE Program
- CVE-2026-55112 · NVD
- FIRST EPSS
- GHSA-8jvx-73vq-fvch · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences