high8.8
CVE-2026-54404
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to esca…
Impact
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ui | Unifi Dream Machine Beast Firmware | through 5.1.15 |
| Ui | Enterprise Fortress Gateway Firmware | through 5.1.15 |
| Ui | Unifi Dream Router Firmware | through 5.1.15 |
| Ui | Unifi Dream Wall Firmware | through 5.1.15 |
| Ui | Unifi Dream Router 7 Firmware | through 5.1.15 |
| Ui | Unifi Express 7 Firmware | through 5.1.15 |
| Ui | Unifi Cloudkey Firmware | through 5.1.15 |
| Ui | Unifi Cloud Key Plus Firmware | through 5.1.15 |
| Ui | Unifi Cloudkey Enterprise Firmware | through 5.1.15 |
| Ui | Unifi Network Video Recorder Firmware | through 5.1.15 |
| Ui | Unifi Network Video Recorder Pro Firmware | through 5.1.15 |
| Ui | Unifi Network Video Recorder Instant Firmware | through 5.1.15 |