Skip to content
OpenAdvisories
Critical · 9.9 CVE-2026-54402 EUVD-2026-41391GHSA-ghgx-h467-6r25

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS …

Published Jul 2, 2026 · Updated Jul 2, 2026 · Assigned by hackerone

Vendor: Ubiquiti Product: Cloud Gateways Product: Cloud Keys Product: Dream Machines Product: Dream Routers Product: Dream Wall Product: Enterprise Firewall Core Product: Enterprise Fortress Gateway Product: Enterprise Video Recorders Product: Express 7 Product: Network Attached Storage Product: Network Video Recorders Product: UniFi OS Server Category: Network devices

Description

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.

Affected products

VendorProductAffectedFixed
Ubiquiti UniFi OS Server < 5.1.19 5.1.19
Ubiquiti Dream Machines < 5.1.19 5.1.19
Ubiquiti Enterprise Fortress Gateway < 5.1.19 5.1.19
Ubiquiti Dream Wall < 5.1.19 5.1.19
Ubiquiti Dream Routers < 5.1.19 5.1.19
Ubiquiti Express 7 < 5.1.19 5.1.19
Ubiquiti Cloud Keys < 5.1.19 5.1.19
Ubiquiti Network Video Recorders < 5.1.19 5.1.19
Ubiquiti Enterprise Video Recorders < 5.1.19 5.1.19
Ubiquiti Cloud Gateways < 5.1.19 5.1.19
Ubiquiti Network Attached Storage < 5.1.19 5.1.19
Ubiquiti Enterprise Firewall Core < 5.1.19 5.1.19

Advisories 2

References