CVE-2026-54402 — CRITICAL (9.9)

Q: What is CVE-2026-54402?

CVE-2026-54402 is a vulnerability with a CVSS score of 9.9 (CRITICAL). A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.

Q: How severe is CVE-2026-54402?

CVE-2026-54402 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.

Q: Is there a patch for CVE-2026-54402?

Check the references section above for vendor advisories and patch information. Affected products include: Ui Unifi Os Server, Ui Unifi Dream Machine Firmware, Ui Unifi Dream Machine, Ui Unifi Dream Machine Pro Firmware, Ui Unifi Dream Machine Pro.

Vulnerability Description

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.

CVSS Score

9.9

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Ui	Unifi Os Server	<= 5.1.15
Ui	Unifi Dream Machine Firmware	<= 5.1.15
Ui	Unifi Dream Machine	-
Ui	Unifi Dream Machine Pro Firmware	<= 5.1.15
Ui	Unifi Dream Machine Pro	-
Ui	Unifi Dream Machine Special Edition Firmware	<= 5.1.15
Ui	Unifi Dream Machine Special Edition	-
Ui	Unifi Dream Machine Pro Max Firmware	<= 5.1.15
Ui	Unifi Dream Machine Pro Max	-
Ui	Unifi Dream Machine Beast Firmware	<= 5.1.15
Ui	Unifi Dream Machine Beast	-
Ui	Enterprise Fortress Gateway Firmware	<= 5.1.15
Ui	Enterprise Fortress Gateway	-
Ui	Unifi Dream Router Firmware	<= 5.1.15
Ui	Unifi Dream Router	-
Ui	Unifi Dream Wall Firmware	<= 5.1.15
Ui	Unifi Dream Wall	-
Ui	Unifi Dream Router 7 Firmware	<= 5.1.15
Ui	Unifi Dream Router 7	-
Ui	Unifi Express 7 Firmware	<= 5.1.15

Related Weaknesses (CWE)

CWE-20 CWE-77

References

https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49Vendor Advisory

FAQ

What is CVE-2026-54402?

CVE-2026-54402 is a vulnerability with a CVSS score of 9.9 (CRITICAL). A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.

How severe is CVE-2026-54402?

CVE-2026-54402 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2026-54402?

Check the references section above for vendor advisories and patch information. Affected products include: Ui Unifi Os Server, Ui Unifi Dream Machine Firmware, Ui Unifi Dream Machine, Ui Unifi Dream Machine Pro Firmware, Ui Unifi Dream Machine Pro.