CVE-2026-110455 Overview
CVE-2026-110455 is a command injection vulnerability in the Ubiquiti UniFi Protect AI Key device. An improper input validation flaw [CWE-20] allows a network-adjacent attacker to execute arbitrary operating system commands on the device under certain conditions. Successful exploitation grants command execution in the context of the vulnerable service, enabling full compromise of confidentiality, integrity, and availability on the affected hardware.
Ubiquiti published the issue in the UI Community Security Advisory bulletin. No proof-of-concept exploit, CISA KEV listing, or in-the-wild exploitation has been reported at publication time.
Critical Impact
An unauthenticated attacker on the network can execute arbitrary commands on UniFi Protect AI Key devices, enabling device takeover and lateral movement into connected camera and surveillance infrastructure.
Affected Products
- Ubiquiti UniFi Protect AI Key
- Deployments integrated with UniFi Protect video management
- Network segments exposing the AI Key management interface
Discovery Timeline
- 2026-10-14 - CVE CVE-2026-110455 published to the National Vulnerability Database
- 2026-10-14 - Ubiquiti published Security Advisory Bulletin 070
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-110455
Vulnerability Analysis
The UniFi Protect AI Key accepts input that is passed to an underlying system command without adequate sanitization. An attacker who can reach the device over the network can craft input containing shell metacharacters or command separators. The device then executes those commands with the privileges of the handling process.
The advisory describes the issue as conditional, indicating specific device states or request parameters are required to reach the vulnerable code path. Attack complexity is therefore higher than a trivial injection, but no authentication or user interaction is required. Successful exploitation results in arbitrary command execution with high impact on confidentiality, integrity, and availability.
The EPSS score is 1.205% with a percentile of 67.7, indicating moderate predicted exploitation likelihood relative to all tracked CVEs.
Root Cause
The root cause is improper input validation [CWE-20] in a request handler on the UniFi Protect AI Key. Input intended as a data parameter is concatenated into a command string executed by the operating system shell. The missing sanitization step allows metacharacters such as ;, |, &, backticks, and $() to break out of the intended argument context.
Attack Vector
The attack vector is network-based. An attacker on the same network segment as the AI Key sends a crafted request to the vulnerable endpoint. The payload embeds shell commands within a parameter the device trusts. Once the device parses and executes the request, the injected commands run on the embedded system.
Ubiquiti has not publicly disclosed the specific endpoint, parameter, or precondition. See the UI Community Security Advisory for vendor-provided technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-110455
Indicators of Compromise
- Unexpected outbound network connections originating from the UniFi Protect AI Key device
- New or modified processes on the device outside normal UniFi Protect firmware behavior
- Unusual HTTP or API requests to the AI Key management interface containing shell metacharacters such as ;, |, &&, or $()
- Configuration or firmware changes not initiated by an administrator
Detection Strategies
- Inspect network traffic to the AI Key for request payloads containing command separators or shell syntax in parameter values
- Correlate authentication logs on the UniFi controller with device configuration changes to identify unauthorized actions
- Baseline expected device behavior and alert on deviations in outbound connections, DNS queries, or process activity
- Monitor for firmware version mismatches across the UniFi fleet that may indicate tampering
Monitoring Recommendations
- Forward UniFi controller and device logs to a centralized SIEM for long-term retention and correlation
- Enable NetFlow or packet capture on VLANs hosting UniFi Protect infrastructure
- Alert on administrative access to the AI Key from unexpected source addresses or outside maintenance windows
- Review access patterns to the AI Key API for anomalous request volumes or malformed parameters
How to Mitigate CVE-2026-110455
Immediate Actions Required
- Apply the firmware update referenced in Ubiquiti Security Advisory Bulletin 070 to all UniFi Protect AI Key devices
- Restrict network access to the AI Key management interface to trusted administrator subnets only
- Audit UniFi Protect devices for signs of unauthorized configuration or firmware changes
- Rotate credentials associated with the UniFi controller and connected services following patching
Patch Information
Ubiquiti released a fixed firmware version addressing CVE-2026-110455. Refer to the UI Community Security Advisory for the specific patched build and upgrade instructions. Apply the update through the UniFi controller or device management interface.
Workarounds
- Isolate the UniFi Protect AI Key on a dedicated management VLAN with strict firewall rules
- Block inbound access to the AI Key from untrusted networks and guest segments
- Disable remote management features that are not required for operations
- Monitor the device continuously until the firmware update can be applied
# Example firewall rule to restrict access to the AI Key management interface
# Allow only the administrator subnet 10.10.0.0/24 to reach the device at 10.20.5.15
iptables -A FORWARD -s 10.10.0.0/24 -d 10.20.5.15 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.20.5.15 -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
