{"id":"CVE-2026-34910","title":"A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.","summary":"A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-20"],"vendor":"ui","product":"unifi_os_server","affected":["unifi_os_server < 5.0.8","unifi_cloud_gateway_industrial_firmware < 5.1.12","unifi_dream_machine_firmware < 5.1.12","unifi_dream_machine_pro_firmware < 5.1.12","unifi_dream_machine_special_edition_firmware < 5.1.12","unifi_dream_machine_pro_max_firmware < 5.1.12","enterprise_fortress_gateway_firmware < 5.1.12","unifi_dream_wall_firmware < 5.1.12","unifi_dream_router_firmware < 5.1.12","unifi_dream_router_7_firmware < 5.1.12","unifi_express_7_firmware < 5.1.12","unifi_network_video_recorder_firmware < 5.1.12","unifi_network_video_recorder_pro_firmware < 5.1.12","unifi_network_video_recorder_instant_firmware < 5.1.12","enterprise_network_video_recorder_firmware < 5.1.12","unifi_cloud_gateway_ultra_firmware < 5.1.12","unifi_cloud_gateway_max_firmware < 5.1.12","unifi_cloud_gateway_fiber_firmware < 5.1.12","unifi_dream_router_5g_max_firmware < 5.1.12","enterprise_network_video_recorder_core_firmware < 5.1.12","unifi_cloud_key_plus_firmware < 5.1.12","unifi_cloudkey_firmware < 5.1.12","unifi_cloudkey_enterprise_firmware < 5.1.12","unifi_network_video_recorder_g2_firmware < 5.1.12","unifi_network_video_recorder_g2_pro_firmware < 5.1.12","unifi_dream_machine_beast_firmware < 5.1.11","unas_2_firmware < 5.1.10","unas_4_firmware < 5.1.10","unas_pro_firmware < 5.1.10","unas_pro_4_firmware < 5.1.10","unas_pro_8_firmware < 5.1.10"],"patched":["unifi_os_server 5.0.8","unifi_cloud_gateway_industrial_firmware 5.1.12","unifi_dream_machine_firmware 5.1.12","unifi_dream_machine_pro_firmware 5.1.12","unifi_dream_machine_special_edition_firmware 5.1.12","unifi_dream_machine_pro_max_firmware 5.1.12","enterprise_fortress_gateway_firmware 5.1.12","unifi_dream_wall_firmware 5.1.12","unifi_dream_router_firmware 5.1.12","unifi_dream_router_7_firmware 5.1.12","unifi_express_7_firmware 5.1.12","unifi_network_video_recorder_firmware 5.1.12","unifi_network_video_recorder_pro_firmware 5.1.12","unifi_network_video_recorder_instant_firmware 5.1.12","enterprise_network_video_recorder_firmware 5.1.12","unifi_cloud_gateway_ultra_firmware 5.1.12","unifi_cloud_gateway_max_firmware 5.1.12","unifi_cloud_gateway_fiber_firmware 5.1.12","unifi_dream_router_5g_max_firmware 5.1.12","enterprise_network_video_recorder_core_firmware 5.1.12","unifi_cloud_key_plus_firmware 5.1.12","unifi_cloudkey_firmware 5.1.12","unifi_cloudkey_enterprise_firmware 5.1.12","unifi_network_video_recorder_g2_firmware 5.1.12","unifi_network_video_recorder_g2_pro_firmware 5.1.12","unifi_dream_machine_beast_firmware 5.1.11","unas_2_firmware 5.1.10","unas_4_firmware 5.1.10","unas_pro_firmware 5.1.10","unas_pro_4_firmware 5.1.10","unas_pro_8_firmware 5.1.10"],"published":"2026-05-22","updated":"2026-07-23","sourceUpdated":"2026-07-23T16:10:00.137","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34910","references":[{"url":"https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b","label":"support@hackerone.com"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34910","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","in-the-wild","exploit-available","kev"],"exploited":true,"exploitAvailable":true,"ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total","timestamp":"2026-05-22T00:00:00+00:00"},"ingestedAt":"2026-10-09T14:20:09.508Z","epss":0.90032,"epssPercentile":0.99793,"kev":true,"kevDateAdded":"2026-06-23","kevDueDate":"2026-06-26","kevRansomware":false,"exploits":{"github":2,"githubRepos":["https://github.com/Boreas37/CVE-2026-34910-PoC","https://github.com/gagaltotal/CVE-2026-34910-unifi-poc"],"nuclei":["CVE-2026-34910"],"checkedAt":"2026-10-27T18:58:49.536Z"},"slug":"CVE-2026-34910","body":"## Overview\n\nA malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.\n\n## Affected\n\n- `unifi_os_server < 5.0.8`\n- `unifi_cloud_gateway_industrial_firmware < 5.1.12`\n- `unifi_dream_machine_firmware < 5.1.12`\n- `unifi_dream_machine_pro_firmware < 5.1.12`\n- `unifi_dream_machine_special_edition_firmware < 5.1.12`\n- `unifi_dream_machine_pro_max_firmware < 5.1.12`\n- `enterprise_fortress_gateway_firmware < 5.1.12`\n- `unifi_dream_wall_firmware < 5.1.12`\n- `unifi_dream_router_firmware < 5.1.12`\n- `unifi_dream_router_7_firmware < 5.1.12`\n- `unifi_express_7_firmware < 5.1.12`\n- `unifi_network_video_recorder_firmware < 5.1.12`\n- `unifi_network_video_recorder_pro_firmware < 5.1.12`\n- `unifi_network_video_recorder_instant_firmware < 5.1.12`\n- `enterprise_network_video_recorder_firmware < 5.1.12`\n- `unifi_cloud_gateway_ultra_firmware < 5.1.12`\n- `unifi_cloud_gateway_max_firmware < 5.1.12`\n- `unifi_cloud_gateway_fiber_firmware < 5.1.12`\n- `unifi_dream_router_5g_max_firmware < 5.1.12`\n- `enterprise_network_video_recorder_core_firmware < 5.1.12`\n- `unifi_cloud_key_plus_firmware < 5.1.12`\n- `unifi_cloudkey_firmware < 5.1.12`\n- `unifi_cloudkey_enterprise_firmware < 5.1.12`\n- `unifi_network_video_recorder_g2_firmware < 5.1.12`\n- `unifi_network_video_recorder_g2_pro_firmware < 5.1.12`\n- `unifi_dream_machine_beast_firmware < 5.1.11`\n- `unas_2_firmware < 5.1.10`\n- `unas_4_firmware < 5.1.10`\n- `unas_pro_firmware < 5.1.10`\n- `unas_pro_4_firmware < 5.1.10`\n- `unas_pro_8_firmware < 5.1.10`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `unifi_os_server 5.0.8`\n- `unifi_cloud_gateway_industrial_firmware 5.1.12`\n- `unifi_dream_machine_firmware 5.1.12`\n- `unifi_dream_machine_pro_firmware 5.1.12`\n- `unifi_dream_machine_special_edition_firmware 5.1.12`\n- `unifi_dream_machine_pro_max_firmware 5.1.12`\n- `enterprise_fortress_gateway_firmware 5.1.12`\n- `unifi_dream_wall_firmware 5.1.12`\n- `unifi_dream_router_firmware 5.1.12`\n- `unifi_dream_router_7_firmware 5.1.12`\n- `unifi_express_7_firmware 5.1.12`\n- `unifi_network_video_recorder_firmware 5.1.12`\n- `unifi_network_video_recorder_pro_firmware 5.1.12`\n- `unifi_network_video_recorder_instant_firmware 5.1.12`\n- `enterprise_network_video_recorder_firmware 5.1.12`\n- `unifi_cloud_gateway_ultra_firmware 5.1.12`\n- `unifi_cloud_gateway_max_firmware 5.1.12`\n- `unifi_cloud_gateway_fiber_firmware 5.1.12`\n- `unifi_dream_router_5g_max_firmware 5.1.12`\n- `enterprise_network_video_recorder_core_firmware 5.1.12`\n- `unifi_cloud_key_plus_firmware 5.1.12`\n- `unifi_cloudkey_firmware 5.1.12`\n- `unifi_cloudkey_enterprise_firmware 5.1.12`\n- `unifi_network_video_recorder_g2_firmware 5.1.12`\n- `unifi_network_video_recorder_g2_pro_firmware 5.1.12`\n- `unifi_dream_machine_beast_firmware 5.1.11`\n- `unas_2_firmware 5.1.10`\n- `unas_4_firmware 5.1.10`\n- `unas_pro_firmware 5.1.10`\n- `unas_pro_4_firmware 5.1.10`\n- `unas_pro_8_firmware 5.1.10`","depth":"hadal","depthScore":98,"depthScoreParts":{"impact":55,"likelihood":18,"exploitation":25,"ransomware":0},"changes":[{"seq":230164,"id":"CVE-2026-34910","ts":1793127533958,"field":"epss","old":"0.45768","new":"0.90032"},{"seq":219356,"id":"CVE-2026-34910","ts":1791808167478,"field":"kev","old":"false","new":"true"},{"seq":219355,"id":"CVE-2026-34910","ts":1791808167478,"field":"epss","old":null,"new":"0.45768"}]}