CVE-2026-50748: A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device

Synopsis

Command injection via improper input validation in the UniFi Access Application (Ubiquiti) allows a network-accessible attacker holding any low-privilege account to inject arbitrary operating system commands on the host device. The vulnerability is reachable over the network with no elevated permissions required and no victim interaction needed, and exploitation gives the attacker full control over confidentiality, integrity, and availability of the host. A patched-image rebuild at version 4.2.29 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the UniFi Access Application service over the network; there is no requirement for local or physical access.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative or elevated credentials.

• Victim interactionNot required

  No user interaction is needed; the attacker exploits the service directly without relying on a victim taking any action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or memory layout knowledge.

Blast Radius

• Reads all data accessible to the host process, including credentials, access control records, and configuration secrets.
• Modifies or deletes files and persisted data on the host device, including application configuration and access logs.
• Executes arbitrary OS commands on the host, enabling installation of backdoors, lateral movement tools, or ransomware.
• Crashes or permanently disrupts the UniFi Access Application service, preventing physical access control operations from functioning.