# cve.now: Ubiquiti The newest entries naming Ubiquiti as an affected vendor (up to 200), of 144 in all, 3 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-119251](https://cve.now/CVE-2026-119251.md): A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop… (CVSS 6.7) - [CVE-2026-119250](https://cve.now/CVE-2026-119250.md): A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in… (CVSS 7.8) - [CVE-2026-119249](https://cve.now/CVE-2026-119249.md): A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop… (CVSS 7.5) - [CVE-2026-116839](https://cve.now/CVE-2026-116839.md): A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found (CVSS 7.1) - [CVE-2026-116838](https://cve.now/CVE-2026-116838.md): A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability… (CVSS 8.8) - [CVE-2026-116837](https://cve.now/CVE-2026-116837.md): A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU… (CVSS 8.8) - [CVE-2026-116836](https://cve.now/CVE-2026-116836.md): A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS)… (CVSS 8.8) - [CVE-2026-110459](https://cve.now/CVE-2026-110459.md): A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain (CVSS 8.6) - [CVE-2026-110458](https://cve.now/CVE-2026-110458.md): A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protec (CVSS 3.7) - [CVE-2026-110457](https://cve.now/CVE-2026-110457.md): A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protec (CVSS 3.7) - [CVE-2026-110456](https://cve.now/CVE-2026-110456.md): A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in Un (CVSS 5.3) - [CVE-2026-110455](https://cve.now/CVE-2026-110455.md): A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in (CVSS 8.1) - [CVE-2026-110454](https://cve.now/CVE-2026-110454.md): A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access (CVSS 5.3) - [CVE-2026-95862](https://cve.now/CVE-2026-95862.md): A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to ex (CVSS 7.5) - [CVE-2026-95861](https://cve.now/CVE-2026-95861.md): A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to (CVSS 7.5) - [CVE-2026-77558](https://cve.now/CVE-2026-77558.md): A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exe (CVSS 7.5) - [CVE-2026-77556](https://cve.now/CVE-2026-77556.md): A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exe (CVSS 7.5) - [CVE-2026-77555](https://cve.now/CVE-2026-77555.md): A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to ex (CVSS 7.5) - [CVE-2026-77544](https://cve.now/CVE-2026-77544.md): A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to ex (CVSS 7.5) - [CVE-2026-77532](https://cve.now/CVE-2026-77532.md): A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwi (CVSS 8.8) - [CVE-2026-77557](https://cve.now/CVE-2026-77557.md): A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalat (CVSS 9.8) - [CVE-2026-77554](https://cve.now/CVE-2026-77554.md): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to exe (CVSS 10.0) - [CVE-2026-77553](https://cve.now/CVE-2026-77553.md): A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access (CVSS 9.9) - [CVE-2026-77552](https://cve.now/CVE-2026-77552.md): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video (CVSS 9.8) - [CVE-2026-77551](https://cve.now/CVE-2026-77551.md): A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in Un (CVSS 9.0) - [CVE-2026-77550](https://cve.now/CVE-2026-77550.md): A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devic (CVSS 10.0) - [CVE-2026-77549](https://cve.now/CVE-2026-77549.md): A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnera (CVSS 9.0) - [CVE-2026-77548](https://cve.now/CVE-2026-77548.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Prot (CVSS 9.9) - [CVE-2026-77547](https://cve.now/CVE-2026-77547.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Acce (CVSS 9.9) - [CVE-2026-77546](https://cve.now/CVE-2026-77546.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Acce (CVSS 9.9) - [CVE-2026-77545](https://cve.now/CVE-2026-77545.md): A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability f (CVSS 9.0) - [CVE-2026-77543](https://cve.now/CVE-2026-77543.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Acce (CVSS 9.9) - [CVE-2026-77542](https://cve.now/CVE-2026-77542.md): A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID Enter (CVSS 9.1) - [CVE-2026-77541](https://cve.now/CVE-2026-77541.md): A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Netwo (CVSS 9.1) - [CVE-2026-77540](https://cve.now/CVE-2026-77540.md): A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS (CVSS 9.1) - [CVE-2026-77539](https://cve.now/CVE-2026-77539.md): A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS (CVSS 9.1) - [CVE-2026-77538](https://cve.now/CVE-2026-77538.md): A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to es (CVSS 8.2) - [CVE-2026-77537](https://cve.now/CVE-2026-77537.md): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to (CVSS 10.0) - [CVE-2026-77536](https://cve.now/CVE-2026-77536.md): A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devi (CVSS 9.9) - [CVE-2026-77535](https://cve.now/CVE-2026-77535.md): A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Net (CVSS 9.1) - [CVE-2026-77534](https://cve.now/CVE-2026-77534.md): A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devi (CVSS 9.9) - [CVE-2026-77533](https://cve.now/CVE-2026-77533.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Prot (CVSS 9.9) - [CVE-2026-55119](https://cve.now/CVE-2026-55119.md): A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Talk A (CVSS 8.1) - [CVE-2026-56842](https://cve.now/CVE-2026-56842.md): A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vulnerability found in Un (CVSS 7.5) - [CVE-2026-55114](https://cve.now/CVE-2026-55114.md): A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Networ (CVSS 8.8) - [CVE-2026-55116](https://cve.now/CVE-2026-55116.md): A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability (CVSS 9.0) - [CVE-2026-56841](https://cve.now/CVE-2026-56841.md): A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi Pr (CVSS 8.8) - [CVE-2026-55115](https://cve.now/CVE-2026-55115.md): A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Applicat (CVSS 9.9) - [CVE-2026-55118](https://cve.now/CVE-2026-55118.md): A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerabil (CVSS 8.3) - [CVE-2026-55112](https://cve.now/CVE-2026-55112.md): A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulner (CVSS 7.5) - [CVE-2026-55117](https://cve.now/CVE-2026-55117.md): A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Access Application to access files (CVSS 8.6) - [CVE-2026-55113](https://cve.now/CVE-2026-55113.md): A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in UniFi Talk Applicatio (CVSS 7.5) - [CVE-2026-55111](https://cve.now/CVE-2026-55111.md): A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodlight devices to acces (CVSS 7.5) - [CVE-2026-54401](https://cve.now/CVE-2026-54401.md): A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges wi (CVSS 7.7) - [CVE-2026-54402](https://cve.now/CVE-2026-54402.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS t (CVSS 9.9) - [CVE-2026-50747](https://cve.now/CVE-2026-50747.md): A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found (CVSS 9.9) - [CVE-2026-50746](https://cve.now/CVE-2026-50746.md): A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to ex (CVSS 10.0) - [CVE-2026-55110](https://cve.now/CVE-2026-55110.md): A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration (CVSS 7.5) - [CVE-2026-54404](https://cve.now/CVE-2026-54404.md): A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found (CVSS 8.8) - [CVE-2026-54400](https://cve.now/CVE-2026-54400.md): A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Acces (CVSS 9.1) - [CVE-2026-54406](https://cve.now/CVE-2026-54406.md): A malicious actor with access to the network and high privileges could exploit a Path Traversal vulnerability found in self-hosted instances (CVSS 8.7) - [CVE-2026-50748](https://cve.now/CVE-2026-50748.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Acce (CVSS 9.9) - [CVE-2026-54408](https://cve.now/CVE-2026-54408.md): A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to by (CVSS 8.6) - [CVE-2026-54409](https://cve.now/CVE-2026-54409.md): A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in Un (CVSS 7.5) - [CVE-2026-54403](https://cve.now/CVE-2026-54403.md): A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypas (CVSS 8.6) - [CVE-2026-54405](https://cve.now/CVE-2026-54405.md): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to (CVSS 7.5) - [CVE-2026-54407](https://cve.now/CVE-2026-54407.md): A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to by (CVSS 8.6) - [CVE-2026-47370](https://cve.now/CVE-2026-47370.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain de (CVSS 9.9) - [CVE-2026-47369](https://cve.now/CVE-2026-47369.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain de (CVSS 9.9) - [CVE-2026-47368](https://cve.now/CVE-2026-47368.md): A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtai (CVSS 8.6) - [CVE-2026-47367](https://cve.now/CVE-2026-47367.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID Enterp (CVSS 9.9) - [CVE-2026-48610](https://cve.now/CVE-2026-48610.md): Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability found (CVSS 8.1) - [CVE-2026-34911](https://cve.now/CVE-2026-34911.md): A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to ac (CVSS 7.7) - [CVE-2026-33000](https://cve.now/CVE-2026-33000.md): A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS (CVSS 9.1) - [CVE-2026-34910](https://cve.now/CVE-2026-34910.md): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a (CVSS 10.0, KEV) - [CVE-2026-34908](https://cve.now/CVE-2026-34908.md): A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauth (CVSS 10.0, KEV) - [CVE-2026-34909](https://cve.now/CVE-2026-34909.md): A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the u (CVSS 10.0, KEV) - [CVE-2026-22563](https://cve.now/CVE-2026-22563.md): A series of Improper Input Validation vulnerabilities could allow a Command Injection by a malicious actor with access to the UniFi Play net (CVSS 9.8) - [CVE-2026-22562](https://cve.now/CVE-2026-22562.md): A malicious actor with access to the UniFi Play network could exploit a Path Traversal vulnerability found in the device firmware to write f (CVSS 9.8) - [CVE-2026-22566](https://cve.now/CVE-2026-22566.md): An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to obtain UniFi Play WiFi crede (CVSS 7.5) - [CVE-2026-22565](https://cve.now/CVE-2026-22565.md): An Improper Input Validation vulnerability could allow a malicious actor with access to the UniFi Play network to cause the device to stop r (CVSS 7.5) - [CVE-2026-22564](https://cve.now/CVE-2026-22564.md): An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauthori (CVSS 9.8) - [CVE-2019-25652](https://cve.now/CVE-2019-25652.md): UniFi Network Controller Improper Certificate Validation Leading to Credential Theft via MITM (CVSS 7.7) - [CVE-2019-25651](https://cve.now/CVE-2019-25651.md): Ubiquiti UniFi Devices Use of AES-CBC Allows Key Recovery and Unauthorized Device Control (CVSS 9.0) - [CVE-2026-22559](https://cve.now/CVE-2026-22559.md): An Improper Input Validation vulnerability in UniFi Network Server may allow unauthorized access to an account if the account owner is socia (CVSS 8.8) - [CVE-2026-22557](https://cve.now/CVE-2026-22557.md): A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access f (CVSS 10.0) - [CVE-2026-22558](https://cve.now/CVE-2026-22558.md): An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor with authenticated access to (CVSS 7.7) - [CVE-2020-37052](https://cve.now/CVE-2020-37052.md): AirControl 1.4.2 - PreAuth Remote Code Execution (CVSS 9.3) - [CVE-2026-21639](https://cve.now/CVE-2026-21639.md): A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote (CVSS 8.8) - [CVE-2026-21638](https://cve.now/CVE-2026-21638.md): A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote (CVSS 8.8) - [CVE-2026-21635](https://cve.now/CVE-2026-21635.md): An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink fea (CVSS 5.3) - [CVE-2026-21634](https://cve.now/CVE-2026-21634.md): A malicious actor with access to the adjacent network could overflow the UniFi Protect Application (Version 6.1.79 and earlier) discovery pr (CVSS 6.5) - [CVE-2025-59467](https://cve.now/CVE-2025-59467.md): A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation (CVSS 7.5) - [CVE-2026-21633](https://cve.now/CVE-2026-21633.md): A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery p (CVSS 8.8) - [CVE-2025-52665](https://cve.now/CVE-2025-52665.md): A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, t (CVSS 10.0) - [CVE-2025-52663](https://cve.now/CVE-2025-52663.md): A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. (CVSS 7.3) - [CVE-2025-48979](https://cve.now/CVE-2025-48979.md): An Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privileges and local access. (CVSS 3.4) - [CVE-2025-24285](https://cve.now/CVE-2025-24285.md): Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with (CVSS 9.8) - [CVE-2025-27213](https://cve.now/CVE-2025-27213.md): An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug B (CVSS 4.9) - [CVE-2025-48978](https://cve.now/CVE-2025-48978.md): An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) could allow a Command Injection by a malicious actor with ac (CVSS 7.5) - [CVE-2025-27215](https://cve.now/CVE-2025-27215.md): An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsu (CVSS 8.1) - [CVE-2025-27214](https://cve.now/CVE-2025-27214.md): A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical o (CVSS 9.8) - [CVE-2025-27216](https://cve.now/CVE-2025-27216.md): Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to e (CVSS 8.8) - [CVE-2025-27217](https://cve.now/CVE-2025-27217.md): A Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside o (CVSS 9.1) - [CVE-2025-27211](https://cve.now/CVE-2025-27211.md): An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with ac (CVSS 7.5) - [CVE-2025-27212](https://cve.now/CVE-2025-27212.md): An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Acces (CVSS 9.8) - [CVE-2025-24292](https://cve.now/CVE-2025-24292.md): A misconfigured query in UniFi Network (v9.1.120 and earlier) could allow users to authenticate to Enterprise WiFi or VPN Server (l2tp and O (CVSS 6.8) - [CVE-2025-24290](https://cve.now/CVE-2025-24290.md): Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow a malicious actor w (CVSS 9.9) - [CVE-2025-24289](https://cve.now/CVE-2025-24289.md): A Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1.3.4 and earlier (CVSS 7.5) - [CVE-2025-23123](https://cve.now/CVE-2025-23123.md): A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a heap buffer overflow vul (CVSS 10.0) - [CVE-2025-23164](https://cve.now/CVE-2025-23164.md): A misconfigured access token mechanism in the Unifi Protect Application (Version 5.3.41 and earlier) could permit the recipient of a "Share (CVSS 4.4) - [CVE-2025-23119](https://cve.now/CVE-2025-23119.md): An Improper Neutralization of Escape Sequences vulnerability could allow an Authentication Bypass with a Remote Code Execution (RCE) by a ma (CVSS 7.5) - [CVE-2025-23116](https://cve.now/CVE-2025-23116.md): An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor wit (CVSS 9.6) - [CVE-2025-23117](https://cve.now/CVE-2025-23117.md): An Insufficient Firmware Update Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras a (CVSS 6.8) - [CVE-2025-23115](https://cve.now/CVE-2025-23115.md): A Use After Free vulnerability on UniFi Protect Cameras could allow a Remote Code Execution (RCE) by a malicious actor with access to UniFi (CVSS 9.0) - [CVE-2025-23118](https://cve.now/CVE-2025-23118.md): An Improper Certificate Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras adjacent (CVSS 6.4) - [CVE-2025-23091](https://cve.now/CVE-2025-23091.md): An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man- (CVSS 5.9) - [CVE-2024-45205](https://cve.now/CVE-2024-45205.md): An Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Network Application) could (CVSS 7.1) - [CVE-2024-42028](https://cve.now/CVE-2024-42028.md): A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and ea (CVSS 8.8) - [CVE-2024-42025](https://cve.now/CVE-2024-42025.md): A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and ea (CVSS 7.8) - [CVE-2024-37380](https://cve.now/CVE-2024-37380.md): A misconfiguration on UniFi U6+ Access Point could cause an incorrect VLAN traffic forwarding to APs meshed to UniFi U6+ Access Point. (CVSS 5.3) - [CVE-2024-34786](https://cve.now/CVE-2024-34786.md): UniFi iOS app 10.15.0 introduces a misconfiguration on 2nd Generation UniFi Access Points configured as standalone (not using UniFi Network (CVSS 4.8) - [CVE-2024-29206](https://cve.now/CVE-2024-29206.md): An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported (CVSS 2.2) - [CVE-2024-29207](https://cve.now/CVE-2024-29207.md): An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. (CVSS 7.5) - [CVE-2024-29208](https://cve.now/CVE-2024-29208.md): An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the (CVSS 2.2) - [CVE-2024-27981](https://cve.now/CVE-2024-27981.md): A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.0.28 and ea (CVSS 9.8) - [CVE-2024-22054](https://cve.now/CVE-2024-22054.md): A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device ma (CVSS 7.5) - [CVE-2023-41721](https://cve.now/CVE-2023-41721.md): Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. (CVSS 10.0) - [CVE-2023-35085](https://cve.now/CVE-2023-35085.md): An integer overflow vulnerability in all UniFi Access Points and Switches, excluding the Switch Flex Mini, with SNMP Monitoring and default (CVSS 9.0) - [CVE-2023-38034](https://cve.now/CVE-2023-38034.md): A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could (CVSS 8.3) - [CVE-2023-31998](https://cve.now/CVE-2023-31998.md): A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices. (CVSS 5.9) - [CVE-2023-32000](https://cve.now/CVE-2023-32000.md): A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor with Site Administra (no CVSS) - [CVE-2023-28365](https://cve.now/CVE-2023-28365.md): A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application a (no CVSS) - [CVE-2023-31997](https://cve.now/CVE-2023-31997.md): UniFi OS 3.1 introduces a misconfiguration on consoles running UniFi Network that allows users on a local network to access MongoDB. (no CVSS) - [CVE-2023-2379](https://cve.now/CVE-2023-2379.md): Ubiquiti EdgeRouter X Web Service denial of service (CVSS 7.5) - [CVE-2023-2378](https://cve.now/CVE-2023-2378.md): Ubiquiti EdgeRouter X Web Management command injection (CVSS 8.6) - [CVE-2023-2377](https://cve.now/CVE-2023-2377.md): Ubiquiti EdgeRouter X Web Management command injection (CVSS 8.6) - [CVE-2023-2376](https://cve.now/CVE-2023-2376.md): Ubiquiti EdgeRouter X Web Management command injection (CVSS 8.6) - [CVE-2023-2375](https://cve.now/CVE-2023-2375.md): Ubiquiti EdgeRouter X Web Management command injection (CVSS 8.6) - [CVE-2023-2374](https://cve.now/CVE-2023-2374.md): Ubiquiti EdgeRouter X Web Management command injection (CVSS 8.6) - [CVE-2023-2373](https://cve.now/CVE-2023-2373.md): Ubiquiti EdgeRouter X Web Management command injection (CVSS 8.6) - [CVE-2023-1458](https://cve.now/CVE-2023-1458.md): A vulnerability has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6 and classified as critical. (CVSS 7.2) - [CVE-2023-1457](https://cve.now/CVE-2023-1457.md): A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. (CVSS 7.2) - [CVE-2023-1456](https://cve.now/CVE-2023-1456.md): A vulnerability, which was classified as critical, has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. (CVSS 7.2) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/ubiquiti Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.