Description
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to execute a Command Injection within such UniFi OS devices or instances.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ubiquiti | UniFi OS Server | < 5.1.15 | 5.1.15 |
| Ubiquiti | Express | < 4.0.15 | 4.0.15 |
| Ubiquiti | UDM | < 5.1.15 | 5.1.15 |
| Ubiquiti | UDM-Pro | < 5.1.15 | 5.1.15 |
| Ubiquiti | UDM-SE | < 5.1.15 | 5.1.15 |
| Ubiquiti | UDM-Pro-Max | < 5.1.15 | 5.1.15 |
| Ubiquiti | UDM-Beast | < 5.1.15 | 5.1.15 |
| Ubiquiti | EFG | < 5.1.15 | 5.1.15 |
| Ubiquiti | UDW | < 5.1.15 | 5.1.15 |
| Ubiquiti | UDR | < 5.1.15 | 5.1.15 |
| Ubiquiti | UDR7 | < 5.1.15 | 5.1.15 |
| Ubiquiti | UDR-5G | < 5.1.15 | 5.1.15 |
| Ubiquiti | Express 7 | < 5.1.15 | 5.1.15 |
| Ubiquiti | UNVR | < 5.1.15 | 5.1.15 |
| Ubiquiti | UNVR-Pro | < 5.1.15 | 5.1.15 |
| Ubiquiti | UNVR-Instant | < 5.1.15 | 5.1.15 |
| Ubiquiti | UNVR-G2 | < 5.1.15 | 5.1.15 |
| Ubiquiti | UNVR-G2-Pro | < 5.1.15 | 5.1.15 |
| Ubiquiti | ENVR | < 5.1.15 | 5.1.15 |
| Ubiquiti | ENVR-Core | < 5.1.15 | 5.1.15 |
| Ubiquiti | UNAS-2 | < 5.1.16 | 5.1.16 |
| Ubiquiti | UNAS-4 | < 5.1.16 | 5.1.16 |
| Ubiquiti | UNAS-Pro | < 5.1.16 | 5.1.16 |
| Ubiquiti | UNAS-Pro-4 | < 5.1.16 | 5.1.16 |
| Ubiquiti | UNAS-Pro-8 | < 5.1.16 | 5.1.16 |
| Ubiquiti | UCKP | < 5.1.15 | 5.1.15 |
| Ubiquiti | UCK | < 5.1.15 | 5.1.15 |
| Ubiquiti | UCK-Enterprise | < 5.1.15 | 5.1.15 |
| Ubiquiti | UCG-Ultra | < 5.1.15 | 5.1.15 |
| Ubiquiti | UCG-Max | < 5.1.15 | 5.1.15 |
| Ubiquiti | UCG-Fiber | < 5.1.15 | 5.1.15 |
| Ubiquiti | UCG-Industrial | < 5.1.15 | 5.1.15 |
Advisories 1
- WID-SEC-2026-1872 Ubiquiti UniFi OS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 11, 2026