CVE-2026-48610: Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices

Synopsis

An improper access control vulnerability in Ubiquiti UniFi OS allows a network-adjacent attacker to make unauthorized changes to affected devices without any authentication. The vulnerability is reachable over the network but requires specific network conditions to exploit, as indicated by the high attack complexity rating. Successful exploitation gives the attacker full read, write, and availability impact over the device. A patched-image rebuild at version 5.1.15 is available on HarborGuard for environments running an affected UniFi OS version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the UniFi OS device over the network; exposure to any network path the device listens on is sufficient to attempt exploitation.

• AuthenticationNot required

  No credentials or account are needed; the vulnerability is exploitable by an unauthenticated attacker.

• Victim interactionNot required

  No user action or social engineering is required; the attacker operates entirely without victim participation.

• Attack complexityDetail

  Exploitation depends on specific network conditions being present, such as particular routing or configuration states, making reliable exploitation conditional on environmental factors the attacker may need to observe or induce.

Blast Radius

• A successful attacker reads sensitive configuration data and credentials stored on the UniFi OS device.
• A successful attacker writes arbitrary configuration changes to the device, including altering network routing rules, firewall policies, or administrative accounts.
• A successful attacker can crash or otherwise disrupt the UniFi OS device, taking it offline and cutting network connectivity for downstream users.
• Because the device acts as a network controller, unauthorized changes can propagate misconfiguration or access to other devices managed by the compromised UniFi OS instance.