CVE-2026-54401
EUVD-2026-4139202.07.2026, 15:17
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| ui | unifi_os_server | 𝑥 ≤ 5.1.15 |
| ui | unifi_dream_machine_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_dream_machine_pro_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_dream_machine_special_edition_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_dream_machine_pro_max_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_dream_machine_beast_firmware | 𝑥 ≤ 5.1.15 |
| ui | enterprise_fortress_gateway_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_dream_router_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_dream_wall_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_dream_router_7_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_express_7_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_cloudkey_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_cloud_key_plus_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_cloudkey_enterprise_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_network_video_recorder_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_network_video_recorder_pro_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_network_video_recorder_instant_firmware | 𝑥 ≤ 5.1.15 |
| ui | enterprise_network_video_recorder_firmware | 𝑥 ≤ 5.1.15 |
| ui | enterprise_network_video_recorder_core_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_network_video_recorder_g2_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_network_video_recorder_g2_pro_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_cloud_gateway_ultra_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_cloud_gateway_max_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_cloud_gateway_industrial_firmware | 𝑥 ≤ 5.1.15 |
| ui | unifi_cloud_gateway_fiber_firmware | 𝑥 ≤ 5.1.15 |
| ui | unas_2_firmware | 𝑥 ≤ 5.1.16 |
| ui | unas_4_firmware | 𝑥 ≤ 5.1.16 |
| ui | unas_pro_firmware | 𝑥 ≤ 5.1.16 |
| ui | unas_pro_4_firmware | 𝑥 ≤ 5.1.16 |
| ui | unas_pro_8_firmware | 𝑥 ≤ 5.1.16 |
| ui | enterprise_firewall_core_firmware | 𝑥 ≤ 5.1.18 |
| ui | unifi_dream_router_5g_max_firmware | 𝑥 ≤ 5.1.15 |
𝑥
= Vulnerable software versions