CVE-2026-77555: UniFi Gateway DoS Vulnerability

CVE-2026-77555 Overview

CVE-2026-77555 is an out-of-bounds write vulnerability [CWE-787] affecting certain Ubiquiti UniFi gateway devices. A network-adjacent attacker can trigger the flaw to cause a Denial of Service (DoS) condition on the affected device. The issue requires no authentication and no user interaction, and it is exploitable over the network.

Ubiquiti disclosed the flaw through UI Community Security Advisory #069. Successful exploitation impacts device availability but does not compromise confidentiality or integrity.

Critical Impact
Unauthenticated network attackers can crash UniFi gateway devices, disrupting routing, firewalling, and network connectivity for downstream clients.

Affected Products

Ubiquiti UniFi gateway devices (specific models listed in vendor advisory)
See UI Community Security Advisory #069 for the complete affected version matrix
Consult the Ubiquiti advisory for firmware baselines requiring updates

Discovery Timeline

2026-09-22 - CVE-2026-77555 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-77555

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds write [CWE-787]. This class of memory corruption occurs when software writes data past the end, or before the beginning, of an intended buffer. In network-facing device firmware, such writes typically corrupt adjacent memory structures, causing the processing daemon or the kernel to crash.

In the case of CVE-2026-77555, exploitation results in a Denial of Service against the UniFi gateway. Because the device sits at the network perimeter, a crash disrupts routing, NAT, VPN termination, and firewalling for all clients behind the gateway. Confidentiality and integrity are not affected, but availability impact is significant.

Root Cause

The root cause is improper bounds checking during processing of attacker-supplied network input. When the affected code path writes data derived from a network request into a fixed-size buffer without validating length or offset, the write overruns the allocation. Ubiquiti has not published implementation-level details in the public advisory.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker with network reachability to the gateway sends a crafted packet or request that triggers the vulnerable write. The device processes the malformed input, corrupts memory, and terminates the affected service or reboots.

Refer to the UI Community Security Advisory #069 for vendor-specific technical guidance. No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-77555

Indicators of Compromise

Unexpected reboots or service restarts on UniFi gateway devices
Gateway process crashes recorded in system logs or syslog forwarders
Sudden interruptions of routing, VPN, or DHCP services without configuration changes
Repeated malformed packets from a single source directed at the gateway management or data plane

Detection Strategies

Forward UniFi gateway syslog to a central log platform and alert on kernel panics, watchdog resets, and daemon restarts
Monitor SNMP uptime counters for unplanned resets that correlate with inbound network traffic spikes
Deploy network IDS signatures once vendor or community rules are published for the specific malformed request pattern

Monitoring Recommendations

Ingest gateway telemetry into a centralized SIEM or data lake to correlate reboots with upstream network events
Baseline normal reboot frequency for each UniFi gateway and alert on deviations
Track availability of WAN, LAN, and VPN interfaces to detect DoS impact quickly

How to Mitigate CVE-2026-77555

Immediate Actions Required

Apply the firmware update referenced in UI Community Security Advisory #069 on all UniFi gateway devices
Restrict network reachability to the gateway management interface to trusted administrative sources
Inventory all UniFi gateway models in the environment and confirm firmware versions against the advisory

Patch Information

Ubiquiti has published fixed firmware through UI Community Security Advisory #069. Administrators should upgrade affected UniFi gateway devices to the versions specified in the advisory. Consult the vendor bulletin for the current fixed release for each hardware model.

Workarounds

Limit exposure of the gateway to untrusted networks where feasible using upstream ACLs
Segment management traffic onto a dedicated VLAN accessible only from administrative hosts
Block inbound traffic from unknown sources to services that are not required to be internet-facing

bash

# Verify UniFi gateway firmware version via SSH
ssh admin@<gateway-ip> "cat /etc/version"

# Compare against fixed version listed in UI Community Security Advisory #069
# Then apply firmware upgrade from the UniFi Network controller or vendor portal