CVE-2026-55116: A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices

Synopsis

An improper access control vulnerability in UniFi OS (affecting Ubiquiti Dream Machines, Dream Routers, Dream Wall, Enterprise Fortress Gateway, Enterprise Firewall Core, Express 7, and Cloud Gateways) allows a network-adjacent attacker with no authentication to make unauthorized changes to the device. The vulnerability is reachable over the network and requires no user interaction, though certain network configurations must be in place for exploitation. Successful exploitation gives an attacker full read, write, and availability impact across the affected device, including the ability to alter device configuration and disrupt operation. A patched-image rebuild at version 5.1.19 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected UniFi OS device over the network; the AV:N vector token confirms the service must be exposed to network-based requests.

• AuthenticationNot required

  No account or credential is needed; PR:N means the attacker can interact with the vulnerable component without any prior authentication.

• Victim interactionNot required

  The exploit proceeds without any action from a logged-in user or administrator; UI:N confirms no social engineering or victim click is required.

• Attack complexityDetail

  AC:H indicates exploitation is not condition-free: certain network configurations must be present, and the attacker may need to satisfy specific environmental factors before the access control bypass is reachable.

Blast Radius

• A successful attacker can read sensitive device configuration data, credentials, and operational state stored on the UniFi OS device.
• The attacker can write arbitrary configuration changes to the device, including altering firewall rules, routing tables, and administrative account settings.
• The attacker can crash or render the device unresponsive, disrupting network connectivity for all hosts behind the affected gateway or router.
• Because the CVSS scope is Changed (S:C), impact can extend beyond the vulnerable component itself to downstream network segments or dependent systems managed by the device.