Command Injection Vulnerability in UniFi OS Devices by Ubiquiti
CVE-2026-34910

10CRITICAL

Key Information:

Vendor
CVE Published:
22 May 2026

What is CVE-2026-34910?

A security flaw in UniFi OS devices allows malicious actors with network access to exploit improper input validation, leading to potential command injection attacks. This vulnerability enables unauthorized commands to be executed on the affected devices, which can compromise the integrity and security of the network. It is crucial for users to apply necessary patches and monitor network activities to mitigate potential risks.

Affected Version(s)

EFG 0 < 5.1.12

ENVR 0 < 5.1.12

ENVR-Core 0 < 5.1.12

References

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.