Description
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ubiquiti | UniFi OS Server | < 5.1.19 | 5.1.19 |
| Ubiquiti | Dream Machines | < 5.1.19 | 5.1.19 |
| Ubiquiti | Enterprise Fortress Gateway | < 5.1.19 | 5.1.19 |
| Ubiquiti | Dream Wall | < 5.1.19 | 5.1.19 |
| Ubiquiti | Dream Routers | < 5.1.19 | 5.1.19 |
| Ubiquiti | Express 7 | < 5.1.19 | 5.1.19 |
| Ubiquiti | Cloud Keys | < 5.1.19 | 5.1.19 |
| Ubiquiti | Network Video Recorders | < 5.1.19 | 5.1.19 |
| Ubiquiti | Enterprise Video Recorders | < 5.1.19 | 5.1.19 |
| Ubiquiti | Cloud Gateways | < 5.1.19 | 5.1.19 |
| Ubiquiti | Network Attached Storage | < 5.1.19 | 5.1.19 |
| Ubiquiti | Enterprise Firewall Core | < 5.1.19 | 5.1.19 |
Advisories 2
- NCSC-2026-0221 Kwetsbaarheden verholpen in UniFi-producten van Ubiquiti Networks NCSC-NL (Netherlands) · Jul 7, 2026
- WID-SEC-2026-2171 Ubiquiti UniFi: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 2, 2026