#Ubiquiti
All CosmicBytez Labs articles tagged #Ubiquiti, across news, security advisories, how-to guides, and projects.
- News
Hackers Hijack D-Link, Ubiquiti Devices to Resell Stolen Bandwidth
GreyNoise found 143 hijacked NAS, NVR, and SAP devices across 34 countries silently enrolled in the Pawns.app residential proxy network.
- Security
CVE-2026-77533: UniFi Protect Command Injection via Improper Input Validation
A critical flaw in UniFi Protect lets a low-privileged, network-adjacent attacker inject OS commands on the host device. Patch to 7.2.105+.
- Security
UniFi Connect Critical RCE via Command Injection CVE-2026-50746
A maximum-severity command injection vulnerability in Ubiquiti's UniFi Connect Application allows any network-accessible attacker to execute arbitrary OS...
- Security
UniFi Talk SQL Injection Chain Enables Host Privilege Escalation CVE-2026-50747
Multiple authenticated SQL injection vulnerabilities in Ubiquiti's UniFi Talk Application can be chained to escalate privileges to host-level access on...
- Security
UniFi Access Application Command Injection RCE CVE-2026-50748
An improper input validation flaw in Ubiquiti's UniFi Access Application enables low-privileged network attackers to inject OS commands and execute...
- Security
UniFi Access Improper Access Control Allows Host Privilege Escalation CVE-2026-54400
A critical improper access control vulnerability in Ubiquiti's UniFi Access Application enables high-privileged network attackers to further escalate...
- Security
CVE-2026-47369: UniFi OS Privilege Escalation via Improper Input Validation
A critical CVSS 9.9 privilege escalation vulnerability in Ubiquiti UniFi OS allows a low-privileged network attacker to escalate privileges within UniFi...
- Security
CVE-2026-47370: UniFi OS Command Injection via Improper Input Validation
A critical CVSS 9.9 command injection vulnerability in Ubiquiti UniFi OS allows a low-privileged network attacker to execute arbitrary commands within...
- News
Ubiquiti Patches Three Max-Severity UniFi OS Vulnerabilities
Ubiquiti has released security updates fixing three CVSS 10.0 vulnerabilities in UniFi OS that allow unauthenticated remote attackers to fully compromise...
- Security
UniFi OS Command Injection via Improper Input Validation
A CVSS 9.1 command injection vulnerability in UniFi OS devices allows a network-adjacent attacker with high privileges to execute arbitrary commands on...
- Security
UniFi OS Improper Access Control — Unauthorized System
A CVSS 10.0 improper access control flaw in UniFi OS allows any network-accessible attacker to make unauthorized changes to the underlying system with no...
- Security
CVE-2026-34909 — UniFi OS Path Traversal Leading to Account
A CVSS 10.0 path traversal vulnerability in UniFi OS allows an unauthenticated network attacker to read arbitrary files, including sensitive account files...
- Security
CVE-2026-34910 — UniFi OS Unauthenticated Command Injection
A CVSS 10.0 command injection vulnerability in UniFi OS allows any network-accessible attacker with no credentials to execute arbitrary OS commands,...