---
id: CVE-2026-34910
title: >-
  A malicious actor with access to the network could exploit an Improper Input
  Validation vulnerability found in UniFi OS devices to execute a Command
  Injection.
summary: >-
  A malicious actor with access to the network could exploit an Improper Input
  Validation vulnerability found in UniFi OS devices to execute a Command
  Injection.
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-20
vendor: ui
product: unifi_os_server
affected:
  - unifi_os_server < 5.0.8
  - unifi_cloud_gateway_industrial_firmware < 5.1.12
  - unifi_dream_machine_firmware < 5.1.12
  - unifi_dream_machine_pro_firmware < 5.1.12
  - unifi_dream_machine_special_edition_firmware < 5.1.12
  - unifi_dream_machine_pro_max_firmware < 5.1.12
  - enterprise_fortress_gateway_firmware < 5.1.12
  - unifi_dream_wall_firmware < 5.1.12
  - unifi_dream_router_firmware < 5.1.12
  - unifi_dream_router_7_firmware < 5.1.12
  - unifi_express_7_firmware < 5.1.12
  - unifi_network_video_recorder_firmware < 5.1.12
  - unifi_network_video_recorder_pro_firmware < 5.1.12
  - unifi_network_video_recorder_instant_firmware < 5.1.12
  - enterprise_network_video_recorder_firmware < 5.1.12
  - unifi_cloud_gateway_ultra_firmware < 5.1.12
  - unifi_cloud_gateway_max_firmware < 5.1.12
  - unifi_cloud_gateway_fiber_firmware < 5.1.12
  - unifi_dream_router_5g_max_firmware < 5.1.12
  - enterprise_network_video_recorder_core_firmware < 5.1.12
  - unifi_cloud_key_plus_firmware < 5.1.12
  - unifi_cloudkey_firmware < 5.1.12
  - unifi_cloudkey_enterprise_firmware < 5.1.12
  - unifi_network_video_recorder_g2_firmware < 5.1.12
  - unifi_network_video_recorder_g2_pro_firmware < 5.1.12
  - unifi_dream_machine_beast_firmware < 5.1.11
  - unas_2_firmware < 5.1.10
  - unas_4_firmware < 5.1.10
  - unas_pro_firmware < 5.1.10
  - unas_pro_4_firmware < 5.1.10
  - unas_pro_8_firmware < 5.1.10
patched:
  - unifi_os_server 5.0.8
  - unifi_cloud_gateway_industrial_firmware 5.1.12
  - unifi_dream_machine_firmware 5.1.12
  - unifi_dream_machine_pro_firmware 5.1.12
  - unifi_dream_machine_special_edition_firmware 5.1.12
  - unifi_dream_machine_pro_max_firmware 5.1.12
  - enterprise_fortress_gateway_firmware 5.1.12
  - unifi_dream_wall_firmware 5.1.12
  - unifi_dream_router_firmware 5.1.12
  - unifi_dream_router_7_firmware 5.1.12
  - unifi_express_7_firmware 5.1.12
  - unifi_network_video_recorder_firmware 5.1.12
  - unifi_network_video_recorder_pro_firmware 5.1.12
  - unifi_network_video_recorder_instant_firmware 5.1.12
  - enterprise_network_video_recorder_firmware 5.1.12
  - unifi_cloud_gateway_ultra_firmware 5.1.12
  - unifi_cloud_gateway_max_firmware 5.1.12
  - unifi_cloud_gateway_fiber_firmware 5.1.12
  - unifi_dream_router_5g_max_firmware 5.1.12
  - enterprise_network_video_recorder_core_firmware 5.1.12
  - unifi_cloud_key_plus_firmware 5.1.12
  - unifi_cloudkey_firmware 5.1.12
  - unifi_cloudkey_enterprise_firmware 5.1.12
  - unifi_network_video_recorder_g2_firmware 5.1.12
  - unifi_network_video_recorder_g2_pro_firmware 5.1.12
  - unifi_dream_machine_beast_firmware 5.1.11
  - unas_2_firmware 5.1.10
  - unas_4_firmware 5.1.10
  - unas_pro_firmware 5.1.10
  - unas_pro_4_firmware 5.1.10
  - unas_pro_8_firmware 5.1.10
published: '2026-05-22'
updated: '2026-07-23'
sourceUpdated: '2026-07-23T16:10:00.137'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34910'
references:
  - url: >-
      https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b
    label: support@hackerone.com
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34910
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - in-the-wild
  - exploit-available
  - kev
exploited: true
exploitAvailable: true
ssvc:
  exploitation: active
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-05-22T00:00:00+00:00'
ingestedAt: '2026-10-09T14:20:09.508Z'
epss: 0.90032
epssPercentile: 0.99793
kev: true
kevDateAdded: '2026-06-23'
kevDueDate: '2026-06-26'
kevRansomware: false
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/Boreas37/CVE-2026-34910-PoC'
    - 'https://github.com/gagaltotal/CVE-2026-34910-unifi-poc'
  nuclei:
    - CVE-2026-34910
  checkedAt: '2026-10-27T18:58:49.536Z'
---

## Overview

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

## Affected

- `unifi_os_server < 5.0.8`
- `unifi_cloud_gateway_industrial_firmware < 5.1.12`
- `unifi_dream_machine_firmware < 5.1.12`
- `unifi_dream_machine_pro_firmware < 5.1.12`
- `unifi_dream_machine_special_edition_firmware < 5.1.12`
- `unifi_dream_machine_pro_max_firmware < 5.1.12`
- `enterprise_fortress_gateway_firmware < 5.1.12`
- `unifi_dream_wall_firmware < 5.1.12`
- `unifi_dream_router_firmware < 5.1.12`
- `unifi_dream_router_7_firmware < 5.1.12`
- `unifi_express_7_firmware < 5.1.12`
- `unifi_network_video_recorder_firmware < 5.1.12`
- `unifi_network_video_recorder_pro_firmware < 5.1.12`
- `unifi_network_video_recorder_instant_firmware < 5.1.12`
- `enterprise_network_video_recorder_firmware < 5.1.12`
- `unifi_cloud_gateway_ultra_firmware < 5.1.12`
- `unifi_cloud_gateway_max_firmware < 5.1.12`
- `unifi_cloud_gateway_fiber_firmware < 5.1.12`
- `unifi_dream_router_5g_max_firmware < 5.1.12`
- `enterprise_network_video_recorder_core_firmware < 5.1.12`
- `unifi_cloud_key_plus_firmware < 5.1.12`
- `unifi_cloudkey_firmware < 5.1.12`
- `unifi_cloudkey_enterprise_firmware < 5.1.12`
- `unifi_network_video_recorder_g2_firmware < 5.1.12`
- `unifi_network_video_recorder_g2_pro_firmware < 5.1.12`
- `unifi_dream_machine_beast_firmware < 5.1.11`
- `unas_2_firmware < 5.1.10`
- `unas_4_firmware < 5.1.10`
- `unas_pro_firmware < 5.1.10`
- `unas_pro_4_firmware < 5.1.10`
- `unas_pro_8_firmware < 5.1.10`

## Remediation

Upgrade past the affected range:

- `unifi_os_server 5.0.8`
- `unifi_cloud_gateway_industrial_firmware 5.1.12`
- `unifi_dream_machine_firmware 5.1.12`
- `unifi_dream_machine_pro_firmware 5.1.12`
- `unifi_dream_machine_special_edition_firmware 5.1.12`
- `unifi_dream_machine_pro_max_firmware 5.1.12`
- `enterprise_fortress_gateway_firmware 5.1.12`
- `unifi_dream_wall_firmware 5.1.12`
- `unifi_dream_router_firmware 5.1.12`
- `unifi_dream_router_7_firmware 5.1.12`
- `unifi_express_7_firmware 5.1.12`
- `unifi_network_video_recorder_firmware 5.1.12`
- `unifi_network_video_recorder_pro_firmware 5.1.12`
- `unifi_network_video_recorder_instant_firmware 5.1.12`
- `enterprise_network_video_recorder_firmware 5.1.12`
- `unifi_cloud_gateway_ultra_firmware 5.1.12`
- `unifi_cloud_gateway_max_firmware 5.1.12`
- `unifi_cloud_gateway_fiber_firmware 5.1.12`
- `unifi_dream_router_5g_max_firmware 5.1.12`
- `enterprise_network_video_recorder_core_firmware 5.1.12`
- `unifi_cloud_key_plus_firmware 5.1.12`
- `unifi_cloudkey_firmware 5.1.12`
- `unifi_cloudkey_enterprise_firmware 5.1.12`
- `unifi_network_video_recorder_g2_firmware 5.1.12`
- `unifi_network_video_recorder_g2_pro_firmware 5.1.12`
- `unifi_dream_machine_beast_firmware 5.1.11`
- `unas_2_firmware 5.1.10`
- `unas_4_firmware 5.1.10`
- `unas_pro_firmware 5.1.10`
- `unas_pro_4_firmware 5.1.10`
- `unas_pro_8_firmware 5.1.10`