CVE-2026-54402: A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device

Synopsis

A command injection vulnerability in UniFi OS (affecting Ubiquiti devices including Dream Machines, Dream Routers, Enterprise Fortress Gateways, Cloud Keys, and Network Video Recorders) allows a network-accessible attacker with any low-privilege account to inject and execute arbitrary operating system commands on the host device. The flaw stems from improper input validation, meaning user-supplied input reaches a system shell without adequate sanitization. Successful exploitation gives the attacker full control over the host, including the ability to read all data, modify system files, and disrupt services. A patched-image rebuild at version 5.1.19 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the UniFi OS service over the network; no physical or local access is required.

• AuthenticationRequired

  A low-privilege account on the device is sufficient; no administrative or elevated credentials are needed beyond basic login access.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker triggers the vulnerability directly without any victim participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions.

Blast Radius

• The attacker executes arbitrary operating system commands on the host device with the privileges of the vulnerable process.
• All data stored on the device, including network configuration, credentials, and captured video footage on NVR models, is readable by the attacker.
• The attacker can modify system files, persist backdoors, or alter network routing and firewall rules on the host.
• The affected service and the broader device can be crashed or rendered unavailable, disrupting network management and security enforcement.