Ubiquiti vulnerabilities
144 CVEs and advisories name Ubiquiti as an affected vendor, 3 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-21635An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink fea
- CVE-2026-21634A malicious actor with access to the adjacent network could overflow the UniFi Protect Application (Version 6.1.79 and earlier) discovery pr
- CVE-2025-59467A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation
- CVE-2026-21633A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery p
- CVE-2025-52665A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, t
- CVE-2025-52663A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled.
- CVE-2025-48979An Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privileges and local access.
- CVE-2025-24285Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with
- CVE-2025-27213An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug B
- CVE-2025-48978An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) could allow a Command Injection by a malicious actor with ac
- CVE-2025-27215An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsu
- CVE-2025-27214A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical o
- CVE-2025-27216Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to e
- CVE-2025-27217A Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside o
- CVE-2025-27211An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with ac
- CVE-2025-27212An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Acces
- CVE-2025-24292A misconfigured query in UniFi Network (v9.1.120 and earlier) could allow users to authenticate to Enterprise WiFi or VPN Server (l2tp and O
- CVE-2025-24290Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow a malicious actor w
- CVE-2025-24289A Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1.3.4 and earlier
- CVE-2025-23123A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a heap buffer overflow vul
- CVE-2025-23164A misconfigured access token mechanism in the Unifi Protect Application (Version 5.3.41 and earlier) could permit the recipient of a "Share
- CVE-2025-23119An Improper Neutralization of Escape Sequences vulnerability could allow an Authentication Bypass with a Remote Code Execution (RCE) by a ma
- CVE-2025-23116An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor wit
- CVE-2025-23117An Insufficient Firmware Update Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras a
- CVE-2025-23115A Use After Free vulnerability on UniFi Protect Cameras could allow a Remote Code Execution (RCE) by a malicious actor with access to UniFi
- CVE-2025-23118An Improper Certificate Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras adjacent
- CVE-2025-23091An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-
- CVE-2024-45205An Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Network Application) could
- CVE-2024-42028A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and ea
- CVE-2024-42025A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and ea