UI vulnerabilities
We track 44 vulnerabilities in UI products across 60+ products. 44 are rated high or critical, and 4 have been exploited in real attacks. The most recent was published on July 2, 2026.
Latest UI vulnerabilities
- 8.8 High severity
EdgeMAX EdgeRouter: Execution with Unnecessary Privileges
A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account to run arbitrary administrator commands.This vulnerability is fixed in Version 2.0.9-hotfix.5 and later.
- 7.8 High severity
UI Desktop for Windows: Improper Privilege Management
A local privilege escalation vulnerability in UI Desktop for Windows (Version 0.55.1.2 and earlier) allows a malicious actor with local access to a Windows device with UI Desktop to run arbitrary commands as SYSTEM.
- 10.0 Critical severity
UniFi Door Access Reader Lite: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability found in the UniFi Door Access Reader Lite’s (UA Lite) firmware (Version 3.8.28.24 and earlier) allows a malicious actor who has gained access to a network to control all connected UA devices. This vulnerability is fixed in Vers
- 9.8 Critical severity
Ubiquiti AirOS Command Injection Exploited
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for Air