UI vulnerabilities
We track 44 vulnerabilities in UI products across 60+ products. 44 are rated high or critical, and 4 have been exploited in real attacks. The most recent was published on July 2, 2026.
Latest UI vulnerabilities
- 8.8 High severity
UniFi Protect Application: Improper Neutralization of Special Elements used in an SQL Command
A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi Protect Application to escalate privileges on the host device.
- 8.6 High severity
UniFi Access Application: Improper Limitation of a Pathname to a Restricted Directory
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Access Application to access files on the host device.
- 9.8 Critical severity
Dream Machines: Improper Access Control
A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.
- 9.9 Critical severity
UniFi Protect Application: Server-Side Request Forgery
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate privileges on the host device.
- 8.8 High severity
Dream Machines: Improper Access Control
A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi OS with UniFi Protect Application to escalate privileges on the host device.
- 7.5 High severity
UniFi Protect Floodlight: Improper Limitation of a Pathname to a Restricted Directory
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodlight devices to access files on the UniFi Protect Floodlight.
- 8.1 High severity
UniFi Protect Application: Improper Initialization
A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UniFi Protect Application to bypass authentication in UniFi Protect Cameras.
- 9.8 Critical severity
UniFi Protect Application: Improper Access Control
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication for data streaming.
- 8.6 High severity
UniFi Protect Application: Improper Access Control
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication in certain UniFi Protect Application API endpoints.
- 8.8 High severity
UniFi OS Server: Improper Neutralization of Special Elements used in an SQL Command
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.
- 8.6 High severity
UniFi OS Server: Improper Limitation of a Pathname to a Restricted Directory
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances.
- 8.8 High severity
UniFi OS Server: Improper Neutralization of Special Elements used in a Command
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.
- 8.8 High severity
UniFi OS Server: Server-Side Request Forgery
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.
- 9.1 Critical severity
UniFi Access Application: Improper Access Control
A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.
- 9.9 Critical severity
A malicious actor with access to the network and low privileges could exploit an Improper…
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.
- 7.7 High severity
UniFi OS Server: Improper Limitation of a Pathname to a Restricted Directory
A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.
- 10.0 Critical severity
Ubiquiti UniFi OS Improper Input Validation Exploited
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
- 10.0 Critical severity
Ubiquiti UniFi OS Path Traversal Exploited
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.
- 10.0 Critical severity
Ubiquiti UniFi OS Improper Access Control Exploited
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
- 8.8 High severity
airMAX AC: Buffer Copy without Checking Size of Input
A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.
- 8.8 High severity
UBB-XG: Improper Neutralization of Special Elements used in a Command
A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product. Affected Products: UBB-XG (Version 1.2.2 and earlier) UDB-Pro/UDB-Pro-
- 8.8 High severity
UniFi Protect Application: Improper Authentication
A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerability in the Unifi Protect Application (Version 6.1.79 and earlier). Affected Products: UniFi Protect Ap
- 9.6 Critical severity
UCRM Argentina AFIP invoices Plugin: Improper Neutralization of Input During Web Page Generation
A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. This plugin is disabled by default. Affected Prod
- 10.0 Critical severity
UniFi Access Application: Missing Authentication for Critical Functionality
A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was
- 9.8 Critical severity
u6-lr_firmware: Use of Hard-coded Credentials
Ubiquiti U6-LR 6.6.65 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. NOTE: In Ubiquiti's view there is no vulnerability as the Hardcoded Password should be after setup not before.
- 7.1 High severity
UniFi iOS App: Improper Certificate Validation
An Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Network Application) could allow a malicious actor with access to an adjacent network to take control of this UniFi Access Point. Affected Product
- 9.8 Critical severity
UniFi Access Points: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could allow a Remote Code Execution (RCE). Affected Products: All UniFi Access Points (Version 6.5.53 and earlier) All UniFi
- 9.8 Critical severity
UniFi Access Points: Integer Overflow or Wraparound
An integer overflow vulnerability in all UniFi Access Points and Switches, excluding the Switch Flex Mini, with SNMP Monitoring and default settings enabled could allow a Remote Code Execution (RCE). Affected Products: All UniFi Access Points (Version 6.5.50 a
- 7.5 High severity
EdgeRouter X: Improper Resource Shutdown or Release
A vulnerability classified as critical has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown part of the component Web Service. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exp
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown function of the component Web Management Interface. This manipulation of the argument suffix-rate-up causes command injection. The attack may be initiated remotely. Th
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The impacted element is an unknown function of the component Web Management Interface. The manipulation of the argument Name results in command injection. The attack can be launched re
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The affected element is an unknown function of the component Web Management Interface. The manipulation of the argument dpi leads to command injection. The attack can be
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. Impacted is an unknown function of the component Web Management Interface. Executing a manipulation of the argument src can lead to command injection. It is possible to launch the at
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This issue affects some unknown processing of the component Web Management Interface. Performing a manipulation of the argument ecn-down results in command injection. It is poss
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This vulnerability affects unknown code of the component Web Management Interface. Such manipulation of the argument ecn-up leads to command injection. The attack may be performed fr
- 7.8 High severity
UI Desktop for Windows: Improper Privilege Management
A local privilege escalation (LPE) vulnerability in UI Desktop for Windows (Version 0.59.1.71 and earlier) allows a malicious actor with local access to a Windows device running said application to submit arbitrary commands as SYSTEM.This vulnerability is fixe
- 9.8 Critical severity
EdgeRouter X: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6 and classified as critical. Affected by this vulnerability is an unknown functionality of the component OSPF Handler. The manipulation of the argument area leads to command injection. The a
- 9.8 Critical severity
EdgeRouter X: Improper Neutralization of Special Elements used in a Command
A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. Affected is an unknown function of the component Static Routing Configuration Handler. The manipulation of the argument next-hop-interface leads to command in
- 9.8 Critical severity
EdgeRouter X: Improper Neutralization of Special Elements used in a Command
A vulnerability, which was classified as critical, has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. This issue affects some unknown processing of the component NAT Configuration Handler. The manipulation leads to command injection. The attack may be ini
- 8.8 High severity
Ubiquiti EdgeRouter(s) and USG(s): Improper Control of Generation of Code
A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix delegation set to dhcpv6-stateless or dhcpv6-stateful, allows a malicious actor directly connected to