CVE-2026-47367: A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Command Injection on the host device

Synopsis

Command injection via improper input validation in Ubiquiti UID Enterprise Agent. The vulnerability is reachable over the network and requires only a low-privilege account, with no victim interaction needed. Successful exploitation gives an attacker full command execution on the host device, with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 1.61.4 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the UID Enterprise Agent service over the network; no physical or local access is needed.

• AuthenticationRequired

  A valid low-privilege account is sufficient; no administrative or elevated credentials are required.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker can trigger the vulnerability directly.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout, or other environmental factors.

Blast Radius

• An attacker executes arbitrary operating system commands on the host device running UID Enterprise Agent.
• All data accessible to the agent process is exposed, including stored credentials, tokens, and configuration files.
• An attacker can modify, delete, or corrupt files and system state on the host.
• The agent process and the underlying host service can be crashed or made unavailable.