CVE-2026-47370: UniFi OS Command Injection Vulnerability

CVE-2026-47370 Overview

CVE-2026-47370 is a command injection vulnerability affecting certain devices running Ubiquiti's UniFi OS. The flaw stems from improper input validation [CWE-20] within UniFi OS components. An authenticated attacker with network access and low privileges can inject and execute arbitrary operating system commands on affected devices or instances.

Ubiquiti disclosed the issue in UI Security Advisory Bulletin #065. The vulnerability carries a network attack vector with low complexity and a scope change, allowing the attacker to impact resources beyond the initially vulnerable component.

Critical Impact
A low-privileged network attacker can execute arbitrary commands on UniFi OS devices, leading to full compromise of confidentiality, integrity, and availability across the managed network infrastructure.

Affected Products

Devices running UniFi OS (specific models identified in UI Security Advisory Bulletin #065)
UniFi OS instances managed through Ubiquiti's controller stack
Network deployments using affected UniFi OS firmware versions

Discovery Timeline

2026-06-12 - CVE-2026-47370 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-47370

Vulnerability Analysis

The vulnerability is classified as Improper Input Validation [CWE-20] resulting in Command Injection. UniFi OS accepts input from authenticated, low-privileged users and fails to properly sanitize or validate that input before incorporating it into a command execution context. The unsanitized input reaches an operating system shell or equivalent command interpreter, enabling attacker-controlled command sequences to execute with the privileges of the underlying UniFi OS service.

Because the CVSS scope is changed, code executed through the injection can affect components beyond the initial vulnerable service. UniFi OS typically runs network management services with elevated privileges, so successful exploitation generally yields broad control over the device. The attacker only needs low privileges, meaning any authenticated user with basic access to the management interface can trigger the flaw.

Root Cause

The root cause is missing or insufficient input validation on a parameter that is later passed to a system command. Without strict allow-list validation or safe argument handling, metacharacters such as ;, |, &, $(), and backticks pass through to the shell. The advisory from Ubiquiti identifies the affected component and firmware versions in UI Security Advisory Bulletin #065.

Attack Vector

The attack vector is network-based. An attacker authenticates to the UniFi OS management interface with any low-privileged account, then submits crafted input to the vulnerable endpoint. The injected command executes within the UniFi OS device context, allowing the attacker to read configuration data, pivot into the managed network, deploy persistence, or disable security controls. No user interaction is required.

No public proof-of-concept code is currently available. Refer to the UI Security Advisory Bulletin #065 for vendor-supplied technical details.

Detection Methods for CVE-2026-47370

Indicators of Compromise

Unexpected child processes spawned by UniFi OS service binaries, particularly shell interpreters such as sh, bash, or busybox
Outbound network connections from UniFi devices to unfamiliar IP addresses or domains
Modifications to UniFi OS configuration files, cron entries, or startup scripts outside scheduled change windows
Authentication events from low-privileged accounts immediately followed by command execution telemetry

Detection Strategies

Monitor UniFi OS audit logs and syslog forwarding for anomalous API calls containing shell metacharacters in input fields
Correlate authentication events with subsequent process creation on UniFi devices to identify privilege misuse
Deploy network detection rules that flag command-injection payload patterns targeting Ubiquiti management endpoints

Monitoring Recommendations

Forward UniFi OS logs to a central SIEM such as Singularity Data Lake for retention and correlation across the environment
Establish baselines for normal administrative activity and alert on deviations in command frequency or source IPs
Track firmware versions across the UniFi fleet and alert when devices running vulnerable builds appear on the network

How to Mitigate CVE-2026-47370

Immediate Actions Required

Apply the firmware updates listed in UI Security Advisory Bulletin #065 to all affected UniFi OS devices without delay
Audit all UniFi OS user accounts and remove or disable unused low-privileged accounts that could be leveraged for exploitation
Restrict management interface access to trusted administrative networks using firewall rules or VPN gating
Rotate credentials and API tokens used with UniFi OS after patching to invalidate any captured during a potential compromise

Patch Information

Ubiquiti has released fixed firmware as documented in the UI Security Advisory Bulletin #065. Administrators should consult the bulletin for the list of affected models and the corresponding patched firmware versions, then schedule updates across all managed devices.

Workarounds

Block external access to UniFi OS management interfaces at the perimeter until firmware updates are applied
Enforce multi-factor authentication on all UniFi OS accounts to raise the cost of credential abuse
Segment UniFi management traffic onto a dedicated VLAN with strict access control lists limiting which hosts can reach the controller

bash

# Example: restrict UniFi OS management access to a trusted subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP