Vulnerabilities in Ubiquiti's UniFi product line — the switches, gateways, and access points that make up the physical layer of a lot of small businesses, campuses, and prosumer networks, often deployed once and rarely touched again. Combined article + CVE feed for the Ubiquiti beat.https://0daynews.com/en-ushttps://0daynews.com/cve/cve-2010-5330/https://0daynews.com/cve/cve-2010-5330/Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.Tue, 25 Aug 2026 00:00:00 GMTUbiquiticriticalcvehttps://0daynews.com/cve/cve-2026-34908/https://0daynews.com/cve/cve-2026-34908/Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.Tue, 25 Aug 2026 00:00:00 GMTUbiquiticriticalcvehttps://0daynews.com/cve/cve-2026-34909/https://0daynews.com/cve/cve-2026-34909/Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.Tue, 25 Aug 2026 00:00:00 GMTUbiquiticriticalcvehttps://0daynews.com/cve/cve-2026-34910/https://0daynews.com/cve/cve-2026-34910/Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.Tue, 25 Aug 2026 00:00:00 GMTUbiquiticriticalcvehttps://0daynews.com/cve/cve-2026-50746/https://0daynews.com/cve/cve-2026-50746/Improper access control in Ubiquiti UniFi Connect ≤3.4.16 lets an attacker with network access execute command injection on the host device. CVSS 10.0. Fixed in 3.4.20.Tue, 25 Aug 2026 00:00:00 GMTUbiquiticriticalcvehttps://0daynews.com/cve/cve-2026-50747/https://0daynews.com/cve/cve-2026-50747/Critical vulnerability in Ubiquiti UniFi products covered by Security Advisory Bulletin 066. CVSS 9.9. Part of a seven-CVE release batch headlined by a CVSS 10.0 command injection in UniFi Connect. Patch to 3.4.20 or later.Tue, 25 Aug 2026 00:00:00 GMTUbiquiticriticalcvehttps://0daynews.com/cve/cve-2026-50748/https://0daynews.com/cve/cve-2026-50748/Critical vulnerability in Ubiquiti UniFi products covered by Security Advisory Bulletin 066. CVSS 9.9. Part of a seven-CVE release batch headlined by a CVSS 10.0 command injection in UniFi Connect. Patch to 3.4.20 or later.Tue, 25 Aug 2026 00:00:00 GMTUbiquiticriticalcvehttps://0daynews.com/cve/cve-2026-54400/https://0daynews.com/cve/cve-2026-54400/Improper access control in Ubiquiti UniFi Access lets a network attacker with existing high privileges escalate on the host device. CVSS 9.1. Fixed in the patch release accompanying Bulletin 066.Tue, 25 Aug 2026 00:00:00 GMTUbiquiticriticalcvehttps://0daynews.com/articles/2026-07-08-ubiquiti-unifi-connect-command-injection-cve-2026-50746/https://0daynews.com/articles/2026-07-08-ubiquiti-unifi-connect-command-injection-cve-2026-50746/Ubiquiti Bulletin 066 patches seven critical UniFi flaws, headlined by a CVSS 10.0 command injection in UniFi Connect 3.4.16 and earlier. Fix: 3.4.20 or later.Wed, 08 Jul 2026 09:00:00 GMTUbiquitiarticle