CVE-2026-54403
Analyzed
Analyzed - Analysis Complete
Path Traversal in UniFi OS Devices
Vulnerability report for CVE-2026-54403, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-07-02
Last updated on: 2026-07-10
Assigner: HackerOne
Description
Description
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ui | unifi_os_server | to 5.1.15 (inc) |
| ui | unifi_dream_machine_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_machine_pro_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_machine_special_edition_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_machine_pro_max_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_machine_beast_firmware | to 5.1.15 (inc) |
| ui | enterprise_fortress_gateway_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_router_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_wall_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_router_7_firmware | to 5.1.15 (inc) |
| ui | unifi_express_7_firmware | to 5.1.15 (inc) |
| ui | unifi_cloudkey_firmware | to 5.1.15 (inc) |
| ui | unifi_cloud_key_plus_firmware | to 5.1.15 (inc) |
| ui | unifi_cloudkey_enterprise_firmware | to 5.1.15 (inc) |
| ui | unifi_network_video_recorder_firmware | to 5.1.15 (inc) |
| ui | unifi_network_video_recorder_pro_firmware | to 5.1.15 (inc) |
| ui | unifi_network_video_recorder_instant_firmware | to 5.1.15 (inc) |
| ui | enterprise_network_video_recorder_firmware | to 5.1.15 (inc) |
| ui | enterprise_network_video_recorder_core_firmware | to 5.1.15 (inc) |
| ui | unifi_network_video_recorder_g2_firmware | to 5.1.15 (inc) |
| ui | unifi_network_video_recorder_g2_pro_firmware | to 5.1.15 (inc) |
| ui | unifi_cloud_gateway_ultra_firmware | to 5.1.15 (inc) |
| ui | unifi_cloud_gateway_max_firmware | to 5.1.15 (inc) |
| ui | unifi_cloud_gateway_industrial_firmware | to 5.1.15 (inc) |
| ui | unifi_cloud_gateway_fiber_firmware | to 5.1.15 (inc) |
| ui | unas_2_firmware | to 5.1.16 (inc) |
| ui | unas_4_firmware | to 5.1.16 (inc) |
| ui | unas_pro_firmware | to 5.1.16 (inc) |
| ui | unas_pro_4_firmware | to 5.1.16 (inc) |
| ui | unas_pro_8_firmware | to 5.1.16 (inc) |
| ui | enterprise_firewall_core_firmware | to 5.1.18 (inc) |
| ui | unifi_dream_router_5g_max_firmware | to 5.1.15 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
