CVEFinder.io

CVE-2026-54404

⚠️ high
🔍 Scan for this CVE
Summary

A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.

CVSS Score
8.8
High
EPSS Score
0.3
Exploit Probability
Published Date
2026-07-02
First Seen: 2026-07-03
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 81.1% of all 338,292 vulnerabilities in our database.

#64,055
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 2, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2026-07-10
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-89

📦 Affected Products 32

Vendor Product Status Affected Versions
ui unifi_dream_machine_firmware Affected
< 5.1.15
ui unifi_dream_machine_pro_firmware Affected
< 5.1.15
ui unifi_os_server Affected
< 5.1.15
ui enterprise_firewall_core_firmware Affected
< 5.1.18
ui enterprise_fortress_gateway_firmware Affected
< 5.1.15
ui enterprise_network_video_recorder_core_firmware Affected
< 5.1.15
ui enterprise_network_video_recorder_firmware Affected
< 5.1.15
ui unas_2_firmware Affected
< 5.1.16
ui unas_4_firmware Affected
< 5.1.16
ui unas_pro_4_firmware Affected
< 5.1.16
ui unas_pro_8_firmware Affected
< 5.1.16
ui unas_pro_firmware Affected
< 5.1.16
ui unifi_cloud_gateway_fiber_firmware Affected
< 5.1.15
ui unifi_cloud_gateway_industrial_firmware Affected
< 5.1.15
ui unifi_cloud_gateway_max_firmware Affected
< 5.1.15
ui unifi_cloud_gateway_ultra_firmware Affected
< 5.1.15
ui unifi_cloud_key_plus_firmware Affected
< 5.1.15
ui unifi_cloudkey_enterprise_firmware Affected
< 5.1.15
ui unifi_cloudkey_firmware Affected
< 5.1.15
ui unifi_dream_machine_beast_firmware Affected
< 5.1.15
ui unifi_dream_machine_pro_max_firmware Affected
< 5.1.15
ui unifi_dream_machine_special_edition_firmware Affected
< 5.1.15
ui unifi_dream_router_7_firmware Affected
< 5.1.15
ui unifi_dream_router_firmware Affected
< 5.1.15
ui unifi_dream_wall_firmware Affected
< 5.1.15
ui unifi_express_7_firmware Affected
< 5.1.15
ui unifi_network_video_recorder_firmware Affected
< 5.1.15
ui unifi_network_video_recorder_g2_firmware Affected
< 5.1.15
ui unifi_network_video_recorder_g2_pro_firmware Affected
< 5.1.15
ui unifi_network_video_recorder_instant_firmware Affected
< 5.1.15
ui unifi_network_video_recorder_pro_firmware Affected
< 5.1.15
ui unifi_dream_router_5g_max_firmware Affected
< 5.1.15

🔗 References 1

https://community.ui.com/releases/Security-Advisory-...
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-54401 ⚠️ high 7.7 0.2 A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to es... 2026-07-02
CVE-2026-54402 ⛔ critical 9.9 0.9 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability... 2026-07-02
CVE-2026-54403 ⚠️ high 8.6 0.5 A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices runni... 2026-07-02
CVE-2026-55110 ⚠️ high 7.5 0.1 A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (COR... 2026-07-02
CVE-2026-55112 ⚠️ high 7.5 0.2 A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper A... 2026-07-02
CVE-2026-34908 ⛔ critical 10.0 58.4 A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS de... 2026-05-22
These CVEs affect the same products