Ubiquiti vulnerabilities
We track 119 vulnerabilities in Ubiquiti products across 60+ products. 119 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on October 29, 2026.
Latest Ubiquiti vulnerabilities
- 8.8 High severity
UBB-XG: Improper Neutralization of Special Elements used in a Command
A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product. Affected Products: UBB-XG (Version 1.2.2 and earlier) UDB-Pro/UDB-Pro-
- 8.8 High severity
UniFi Protect Application: Improper Authentication
A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerability in the Unifi Protect Application (Version 6.1.79 and earlier). Affected Products: UniFi Protect Ap
- 9.6 Critical severity
UCRM Argentina AFIP invoices Plugin: Improper Neutralization of Input During Web Page Generation
A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. This plugin is disabled by default. Affected Prod
- 10.0 Critical severity
UniFi Access Application: Missing Authentication for Critical Functionality
A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was
- 7.3 High severity
UniFi Talk Touch: Active Debug Code
A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This issue could allow an attacker with access to the UniFi Talk management network to invoke internal debug operations throug
- 7.5 High severity
EdgeMAX EdgeSwitch: Improper Neutralization of Special Elements used in a Command
An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch adjacent network. Affected Products: EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) Mitigation: Upda
- 9.1 Critical severity
UISP Application: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside of UISP Application scope.
- 8.8 High severity
UISP Application: Incorrect Permission Assignment for Critical Resource
Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to escalate privileges.
- 8.1 High severity
UniFi Connect Display Cast: Improper Access Control
An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsupported changes to the system. Affected Products: UniFi Connect Display Cast (Version 1.10.3 and earlier) UniFi Connect
- 9.8 Critical severity
UniFi Connect EV Station Pro: Missing Authentication for Critical Functionality
A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical or adjacent access to perform an unauthorized factory reset. Affected Products: UniFi Connect EV Station Pro (Version 1.5
- 9.8 Critical severity
UniFi Connect EV Station Lite: Improper Neutralization of Special Elements used in a Command
Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with network access to the UniFi Connect EV Station Lite. Affected Products: UniFi Connect EV Station Lite (Version 1.5.1 and
- 9.8 Critical severity
An Improper Input Validation in certain UniFi Access devices could allow a Command Injection…
An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network. Affected Products: UniFi Access Reader Pro (Version 2.14.21 and earlier) UniFi Access G2 Reader Pr
- 7.5 High severity
An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a…
An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch adjacent network.
- 9.9 Critical severity
UISP Application: Improper Neutralization of Special Elements used in an SQL Command
Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow a malicious actor with low privileges to escalate privileges.
- 7.5 High severity
UCRM Client Signup Plugin: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1.3.4 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. The plugin is
- 10.0 Critical severity
UniFi Protect Cameras: Heap-based Buffer Overflow
A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a heap buffer overflow vulnerability in the UniFi Protect Cameras (Version 4.75.43 and earlier) firmware.
- 7.5 High severity
UniFi Protect Cameras: Improper Neutralization of Special Elements used in a Command
An Improper Neutralization of Escape Sequences vulnerability could allow an Authentication Bypass with a Remote Code Execution (RCE) by a malicious actor with access to UniFi Protect Cameras adjacent network.
- 9.6 Critical severity
UniFi Protect Application: Improper Authentication
An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor with access to UniFi Protect Cameras adjacent network to take control of UniFi Protect Cameras.
- 9.0 Critical severity
UniFi Protect Cameras: Use After Free
A Use After Free vulnerability on UniFi Protect Cameras could allow a Remote Code Execution (RCE) by a malicious actor with access to UniFi Protect Cameras management network.
- 7.1 High severity
UniFi iOS App: Improper Certificate Validation
An Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Network Application) could allow a malicious actor with access to an adjacent network to take control of this UniFi Access Point. Affected Product
- 8.8 High severity
UniFi Network Application: Incorrect Default Permissions
A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and earlier) allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network
- 7.8 High severity
UniFi Network Application: Improper Neutralization of Special Elements used in a Command
A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and earlier) allows a malicious actor with unifi user shell access to escalate privileges to root on the host device.
- 7.5 High severity
UniFi Connect Application: Improper Access Control
An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. Affected Products: UniFi Connect Application (Version 3.7.9 and earlier) UniFi Connect EV Station (Version 1.1.18 and earlier) Un
- 9.8 Critical severity
UniFi Network Application: Improper Neutralization of Special Elements used in a Command
A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.0.28 and earlier) allows a malicious actor with UniFi Network Application Administrator credentials to escalate privileges to root
- 7.5 High severity
A malformed discovery packet sent by a malicious actor with preexisting access to the network…
A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery. Affected Products: UniFi Access Points UniFi Switches UniFi LTE Backup UniFi Express (Only Mesh
- 9.8 Critical severity
UniFi Access Points: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could allow a Remote Code Execution (RCE). Affected Products: All UniFi Access Points (Version 6.5.53 and earlier) All UniFi
- 9.8 Critical severity
UniFi Access Points: Integer Overflow or Wraparound
An integer overflow vulnerability in all UniFi Access Points and Switches, excluding the Switch Flex Mini, with SNMP Monitoring and default settings enabled could allow a Remote Code Execution (RCE). Affected Products: All UniFi Access Points (Version 6.5.50 a
- 9.0 Critical severity
UniFi OS: Incorrect Authorization
UniFi OS 3.1 introduces a misconfiguration on consoles running UniFi Network that allows users on a local network to access MongoDB. Applicable Cloud Keys that are both (1) running UniFi OS 3.1 and (2) hosting the UniFi Network application. "Applicable Cloud K
- 9.1 Critical severity
UniFi Network application: Improper Neutralization of Special Elements used in a Command
A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application administrators to execute malicious commands on the host device being restored.
- 7.5 High severity
EdgeRouter X: Improper Resource Shutdown or Release
A vulnerability classified as critical has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown part of the component Web Service. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exp
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown function of the component Web Management Interface. This manipulation of the argument suffix-rate-up causes command injection. The attack may be initiated remotely. Th
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The impacted element is an unknown function of the component Web Management Interface. The manipulation of the argument Name results in command injection. The attack can be launched re
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The affected element is an unknown function of the component Web Management Interface. The manipulation of the argument dpi leads to command injection. The attack can be
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. Impacted is an unknown function of the component Web Management Interface. Executing a manipulation of the argument src can lead to command injection. It is possible to launch the at
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This issue affects some unknown processing of the component Web Management Interface. Performing a manipulation of the argument ecn-down results in command injection. It is poss
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This vulnerability affects unknown code of the component Web Management Interface. Such manipulation of the argument ecn-up leads to command injection. The attack may be performed fr
- 9.8 Critical severity
EdgeRouter X: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6 and classified as critical. Affected by this vulnerability is an unknown functionality of the component OSPF Handler. The manipulation of the argument area leads to command injection. The a
- 9.8 Critical severity
EdgeRouter X: Improper Neutralization of Special Elements used in a Command
A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. Affected is an unknown function of the component Static Routing Configuration Handler. The manipulation of the argument next-hop-interface leads to command in
- 9.8 Critical severity
EdgeRouter X: Improper Neutralization of Special Elements used in a Command
A vulnerability, which was classified as critical, has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. This issue affects some unknown processing of the component NAT Configuration Handler. The manipulation leads to command injection. The attack may be ini