CVE-2026-54402
Analyzed
Analyzed - Analysis Complete
Command Injection in UniFi OS
Vulnerability report for CVE-2026-54402, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-07-02
Last updated on: 2026-07-10
Assigner: HackerOne
Description
Description
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ui | unifi_os_server | to 5.1.15 (inc) |
| ui | unifi_dream_machine_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_machine_pro_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_machine_special_edition_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_machine_pro_max_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_machine_beast_firmware | to 5.1.15 (inc) |
| ui | enterprise_fortress_gateway_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_router_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_wall_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_router_7_firmware | to 5.1.15 (inc) |
| ui | unifi_express_7_firmware | to 5.1.15 (inc) |
| ui | unifi_cloudkey_firmware | to 5.1.15 (inc) |
| ui | unifi_cloud_key_plus_firmware | to 5.1.15 (inc) |
| ui | unifi_cloudkey_enterprise_firmware | to 5.1.15 (inc) |
| ui | unifi_network_video_recorder_firmware | to 5.1.15 (inc) |
| ui | unifi_network_video_recorder_pro_firmware | to 5.1.15 (inc) |
| ui | unifi_network_video_recorder_instant_firmware | to 5.1.15 (inc) |
| ui | enterprise_network_video_recorder_core_firmware | to 5.1.15 (inc) |
| ui | unifi_network_video_recorder_g2_firmware | to 5.1.15 (inc) |
| ui | unifi_network_video_recorder_g2_pro_firmware | to 5.1.15 (inc) |
| ui | unifi_cloud_gateway_ultra_firmware | to 5.1.15 (inc) |
| ui | unifi_cloud_gateway_max_firmware | to 5.1.15 (inc) |
| ui | unifi_cloud_gateway_industrial_firmware | to 5.1.15 (inc) |
| ui | unifi_cloud_gateway_fiber_firmware | to 5.1.15 (inc) |
| ui | unas_2_firmware | to 5.1.16 (inc) |
| ui | unas_4_firmware | to 5.1.16 (inc) |
| ui | unas_pro_firmware | to 5.1.16 (inc) |
| ui | unas_pro_4_firmware | to 5.1.16 (inc) |
| ui | unas_pro_8_firmware | to 5.1.16 (inc) |
| ui | enterprise_firewall_core_firmware | to 5.1.18 (inc) |
| ui | unifi_dream_router_5g_max_firmware | to 5.1.15 (inc) |
| ui | enterprise_network_video_recorder_firmware | to 5.1.15 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
