CVE-2026-54404
Analyzed
Analyzed - Analysis Complete
Authenticated SQL Injection in UniFi OS
Vulnerability report for CVE-2026-54404, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-07-02
Last updated on: 2026-07-10
Assigner: HackerOne
Description
Description
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ui | unifi_dream_machine_beast_firmware | to 5.1.15 (inc) |
| ui | enterprise_fortress_gateway_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_router_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_wall_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_router_7_firmware | to 5.1.15 (inc) |
| ui | unifi_express_7_firmware | to 5.1.15 (inc) |
| ui | unifi_cloudkey_firmware | to 5.1.15 (inc) |
| ui | unifi_cloud_key_plus_firmware | to 5.1.15 (inc) |
| ui | unifi_cloudkey_enterprise_firmware | to 5.1.15 (inc) |
| ui | unifi_network_video_recorder_firmware | to 5.1.15 (inc) |
| ui | unifi_network_video_recorder_pro_firmware | to 5.1.15 (inc) |
| ui | unifi_network_video_recorder_instant_firmware | to 5.1.15 (inc) |
| ui | enterprise_network_video_recorder_firmware | to 5.1.15 (inc) |
| ui | enterprise_network_video_recorder_core_firmware | to 5.1.15 (inc) |
| ui | unifi_network_video_recorder_g2_firmware | to 5.1.15 (inc) |
| ui | unifi_network_video_recorder_g2_pro_firmware | to 5.1.15 (inc) |
| ui | unifi_cloud_gateway_ultra_firmware | to 5.1.15 (inc) |
| ui | unifi_cloud_gateway_max_firmware | to 5.1.15 (inc) |
| ui | unifi_cloud_gateway_industrial_firmware | to 5.1.15 (inc) |
| ui | unifi_cloud_gateway_fiber_firmware | to 5.1.15 (inc) |
| ui | unas_2_firmware | to 5.1.16 (inc) |
| ui | unas_4_firmware | to 5.1.16 (inc) |
| ui | unas_pro_firmware | to 5.1.16 (inc) |
| ui | unas_pro_4_firmware | to 5.1.16 (inc) |
| ui | unas_pro_8_firmware | to 5.1.16 (inc) |
| ui | enterprise_firewall_core_firmware | to 5.1.18 (inc) |
| ui | unifi_os_server | to 5.1.15 (inc) |
| ui | unifi_dream_machine_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_machine_pro_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_machine_special_edition_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_machine_pro_max_firmware | to 5.1.15 (inc) |
| ui | unifi_dream_router_5g_max_firmware | to 5.1.15 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
