Ubiquiti UniFi vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
39 matching records
- High7.5A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiCheck if you run itEPSS 0.29%Jan 5, 2026
- Critical10.0ui unifi_access Missing Authentication for Critical FunctionPatch nowKEVEPSS 41.09%Oct 30, 2025
- High7.3A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled.Check if you run itEPSS 0.24%Oct 30, 2025
- Low3.4An Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privileges and local access.Check if you run itEPSS 0.43%Aug 28, 2025
- Critical9.8Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with network access to the UniFi Connect EV SCheck if you run itEPSS 1.19%Aug 21, 2025
- Critical9.8An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network.Check if you run itEPSS 1.13%Aug 4, 2025
- High7.5An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch adjacent network.Check if you run itEPSS 0.50%Aug 4, 2025
- Medium6.8A misconfigured query in UniFi Network (v9.1.120 and earlier) could allow users to authenticate to Enterprise WiFi or VPN Server (l2tp and OpenVPN) using a device’s MAC address froCheck if you run itEPSS 0.35%Jun 29, 2025
- Critical9.9Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow a malicious actor with low privileges to escalate privilegeCheck if you run itEPSS 0.36%Jun 29, 2025
- High7.5A Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1.3.4 and earlier) could allow privilege escalation if anCheck if you run itEPSS 0.18%Jun 29, 2025
- Medium4.4A misconfigured access token mechanism in the Unifi Protect Application (Version 5.3.41 and earlier) could permit the recipient of a "Share Livestream" link to maintain access to tCheck if you run itEPSS 0.35%May 19, 2025
- Critical10.0A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a heap buffer overflow vulnerability in the UniFi Protect CamerasCheck if you run itEPSS 1.16%May 19, 2025
- Unknownui unifi_network_application Improper Neutralization of Special Elements used in a Command ('Command Injection')Patch nowKEVEPSS 0.88%Sep 18, 2024
- Critical9.8Ubiquiti AirOS Command Injection VulnerabilityPatch nowKEVEPSS 40.23%Jun 11, 2019