Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-27212

Summary
Assigner-hackerone
Assigner Org ID-36234546-b8fa-4601-9d6f-f4e334aa8ea1
Published At-04 Aug, 2025 | 22:12
Updated At-05 Aug, 2025 | 13:33
Rejected At-
Credits

An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network. Affected Products: UniFi Access Reader Pro (Version 2.14.21 and earlier) UniFi Access G2 Reader Pro (Version 1.10.32 and earlier) UniFi Access G3 Reader Pro (Version 1.10.30 and earlier) UniFi Access Intercom (Version 1.7.28 and earlier) UniFi Access G3 Intercom (Version 1.7.29 and earlier) UniFi Access Intercom Viewer (Version 1.3.20 and earlier) Mitigation: Update UniFi Access Reader Pro Version 2.15.9 or later Update UniFi Access G2 Reader Pro Version 1.11.23 or later Update UniFi Access G3 Reader Pro Version 1.11.22 or later Update UniFi Access Intercom Version 1.8.22 or later Update UniFi Access G3 Intercom Version 1.8.22 or later Update UniFi Access Intercom Viewer Version 1.4.39 or later

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:hackerone
Assigner Org ID:36234546-b8fa-4601-9d6f-f4e334aa8ea1
Published At:04 Aug, 2025 | 22:12
Updated At:05 Aug, 2025 | 13:33
Rejected At:
▼CVE Numbering Authority (CNA)

An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network. Affected Products: UniFi Access Reader Pro (Version 2.14.21 and earlier) UniFi Access G2 Reader Pro (Version 1.10.32 and earlier) UniFi Access G3 Reader Pro (Version 1.10.30 and earlier) UniFi Access Intercom (Version 1.7.28 and earlier) UniFi Access G3 Intercom (Version 1.7.29 and earlier) UniFi Access Intercom Viewer (Version 1.3.20 and earlier) Mitigation: Update UniFi Access Reader Pro Version 2.15.9 or later Update UniFi Access G2 Reader Pro Version 1.11.23 or later Update UniFi Access G3 Reader Pro Version 1.11.22 or later Update UniFi Access Intercom Version 1.8.22 or later Update UniFi Access G3 Intercom Version 1.8.22 or later Update UniFi Access Intercom Viewer Version 1.4.39 or later

Affected Products
Vendor
Ubiquiti Inc.Ubiquiti Inc
Product
UniFi Access Reader Pro
Default Status
unaffected
Versions
Affected
  • From 2.15.9 before 2.15.9 (semver)
Vendor
Ubiquiti Inc.Ubiquiti Inc
Product
UniFi Access G2 Reader Pro
Default Status
unaffected
Versions
Affected
  • From 1.11.23 before 1.11.23 (semver)
Vendor
Ubiquiti Inc.Ubiquiti Inc
Product
UniFi Access G3 Reader Pro
Default Status
unaffected
Versions
Affected
  • From 1.11.22 before 1.11.22 (semver)
Vendor
Ubiquiti Inc.Ubiquiti Inc
Product
UniFi Access Intercom
Default Status
unaffected
Versions
Affected
  • From 1.8.22 before 1.8.22 (semver)
Vendor
Ubiquiti Inc.Ubiquiti Inc
Product
UniFi Access G3 Intercom
Default Status
unaffected
Versions
Affected
  • From 1.8.22 before 1.8.22 (semver)
Vendor
Ubiquiti Inc.Ubiquiti Inc
Product
UniFi Access Intercom Viewer
Default Status
unaffected
Versions
Affected
  • From 1.4.39 before 1.4.39 (semver)
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://community.ui.com/releases/Security-Advisory-Bulletin-051-051/583fa6e1-3d85-42ec-a453-651d1653c9b3
N/A
Hyperlink: https://community.ui.com/releases/Security-Advisory-Bulletin-051-051/583fa6e1-3d85-42ec-a453-651d1653c9b3
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Problem Types
TypeCWE IDDescription
CWECWE-20CWE-20 Improper Input Validation
CWECWE-77CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Type: CWE
CWE ID: CWE-20
Description: CWE-20 Improper Input Validation
Type: CWE
CWE ID: CWE-77
Description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Metrics
VersionBase scoreBase severityVector
3.19.8CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Version: 3.1
Base score: 9.8
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:support@hackerone.com
Published At:04 Aug, 2025 | 23:15
Updated At:05 Aug, 2025 | 14:34

An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network. Affected Products: UniFi Access Reader Pro (Version 2.14.21 and earlier) UniFi Access G2 Reader Pro (Version 1.10.32 and earlier) UniFi Access G3 Reader Pro (Version 1.10.30 and earlier) UniFi Access Intercom (Version 1.7.28 and earlier) UniFi Access G3 Intercom (Version 1.7.29 and earlier) UniFi Access Intercom Viewer (Version 1.3.20 and earlier) Mitigation: Update UniFi Access Reader Pro Version 2.15.9 or later Update UniFi Access G2 Reader Pro Version 1.11.23 or later Update UniFi Access G3 Reader Pro Version 1.11.22 or later Update UniFi Access Intercom Version 1.8.22 or later Update UniFi Access G3 Intercom Version 1.8.22 or later Update UniFi Access Intercom Viewer Version 1.4.39 or later

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.19.8CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 9.8
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE Matches

Weaknesses
CWE IDTypeSource
CWE-20Secondary134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-77Secondary134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE ID: CWE-20
Type: Secondary
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE ID: CWE-77
Type: Secondary
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://community.ui.com/releases/Security-Advisory-Bulletin-051-051/583fa6e1-3d85-42ec-a453-651d1653c9b3support@hackerone.com
N/A
Hyperlink: https://community.ui.com/releases/Security-Advisory-Bulletin-051-051/583fa6e1-3d85-42ec-a453-651d1653c9b3
Source: support@hackerone.com
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

1620Records found

CVE-2023-38034
Matching Score-10
Assigner-HackerOne
ShareView Details
Matching Score-10
Assigner-HackerOne
CVSS Score-8.3||HIGH
EPSS-1.02% / 59.87%
||
7 Day CHG~0.00%
Published-10 Aug, 2023 | 18:58
Updated-04 Dec, 2024 | 16:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could allow a Remote Code Execution (RCE). Affected Products: All UniFi Access Points (Version 6.5.53 and earlier) All UniFi Switches (Version 6.5.32 and earlier) -USW Flex Mini excluded. Mitigation: Update UniFi Access Points to Version 6.5.62 or later. Update UniFi Switches to Version 6.5.59 or later.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-usw-pro-24usw-pro-24-poeus-48-500wusw-flex-xgusw-enterprisexg-24ubb-xgusw-flexu6-lrunifi_switch_firmwareus-16-150wusw-lite-16-poeus-xg-6poeu6-extenderus-8-150wusw-48-poeuap-ac-prou6\+usw-enterprise-24-poeusw-industrialusw-48usw-pro-48-poeusw-24us-8-60wusw-enterprise-8-poeu6-prouap-ac-liteu6-iwuwb-xguap-ac-musw-aggregationusw-lite-8-poeu6-enterpriseusw-24-poeuap-ac-iwu6-liteunifi_uap_firmwareusw-mission-criticalusw-pro-48u6-meshuap-ac-m-prousw-16-poeusw-pro-aggregationus-24-250wubbuap-ac-lru6-enterprise-iwusw-enterprise-48-poeUniFi Access PointsUniFi Switches
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2026-22563
Matching Score-10
Assigner-HackerOne
ShareView Details
Matching Score-10
Assigner-HackerOne
CVSS Score-9.8||CRITICAL
EPSS-1.05% / 60.77%
||
7 Day CHG~0.00%
Published-13 Apr, 2026 | 21:28
Updated-30 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A series of Improper Input Validation vulnerabilities could allow a Command Injection by a malicious actor with access to the UniFi Play network. Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier)
 UniFi Play Audio Port  (Version 1.0.24 and earlier)
 Mitigation: Update UniFi Play PowerAmp to Version 1.0.38 or later
 Update UniFi Play Audio Port  to Version 1.1.9 or later

Action-Not Available
Vendor-Ubiquiti Inc.
Product-UniFi Play Audio PortUniFi Play PowerAmp
CWE ID-CWE-20
Improper Input Validation
CVE-2025-24285
Matching Score-10
Assigner-HackerOne
ShareView Details
Matching Score-10
Assigner-HackerOne
CVSS Score-9.8||CRITICAL
EPSS-1.15% / 63.61%
||
7 Day CHG-0.03%
Published-21 Aug, 2025 | 00:01
Updated-26 Feb, 2026 | 17:48
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with network access to the UniFi Connect EV Station Lite. Affected Products: UniFi Connect EV Station Lite (Version 1.5.1 and earlier) Mitigation: Update UniFi Connect EV Station Lite to Version 1.5.2 or later

Action-Not Available
Vendor-Ubiquiti Inc.
Product-UniFi Connect EV Station Lite
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2024-27981
Matching Score-10
Assigner-HackerOne
ShareView Details
Matching Score-10
Assigner-HackerOne
CVSS Score-9.8||CRITICAL
EPSS-1.16% / 63.81%
||
7 Day CHG~0.00%
Published-04 Apr, 2024 | 22:16
Updated-15 Apr, 2026 | 00:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.0.28 and earlier) allows a malicious actor with UniFi Network Application Administrator credentials to escalate privileges to root on the host device. Affected Products: UniFi Network Application (Version 8.0.28 and earlier) . Mitigation: Update UniFi Network Application to Version 8.1.113 or later.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-UniFi Network Applicationunifi_network_application
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2026-55116
Matching Score-8
Assigner-HackerOne
ShareView Details
Matching Score-8
Assigner-HackerOne
CVSS Score-9||CRITICAL
EPSS-0.41% / 33.97%
||
7 Day CHG+0.18%
Published-02 Jul, 2026 | 14:50
Updated-09 Jul, 2026 | 18:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-unifi_connectDream MachinesExpress 7Cloud GatewaysDream WallEnterprise Firewall CoreDream RoutersEnterprise Fortress Gateway
CWE ID-CWE-284
Improper Access Control
CVE-2026-54408
Matching Score-8
Assigner-HackerOne
ShareView Details
Matching Score-8
Assigner-HackerOne
CVSS Score-8.6||HIGH
EPSS-0.28% / 20.21%
||
7 Day CHG~0.00%
Published-02 Jul, 2026 | 14:49
Updated-07 Jul, 2026 | 16:33
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication for data streaming.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-unifi_protectUniFi Protect Application
CWE ID-CWE-284
Improper Access Control
CVE-2025-27214
Matching Score-8
Assigner-HackerOne
ShareView Details
Matching Score-8
Assigner-HackerOne
CVSS Score-9.8||CRITICAL
EPSS-0.40% / 32.41%
||
7 Day CHG+0.02%
Published-21 Aug, 2025 | 00:01
Updated-22 Aug, 2025 | 18:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical or adjacent access to perform an unauthorized factory reset. Affected Products: UniFi Connect EV Station Pro (Version 1.5.18 and earlier) Mitigation: Update UniFi Connect EV Station Pro to Version 1.5.27 or later

Action-Not Available
Vendor-Ubiquiti Inc.
Product-UniFi Connect EV Station Pro
CWE ID-CWE-306
Missing Authentication for Critical Function
CVE-2026-22564
Matching Score-8
Assigner-HackerOne
ShareView Details
Matching Score-8
Assigner-HackerOne
CVSS Score-9.8||CRITICAL
EPSS-0.42% / 34.45%
||
7 Day CHG~0.00%
Published-13 Apr, 2026 | 21:28
Updated-30 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauthorized changes to the system.
 Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier)
 UniFi Play Audio Port  (Version 1.0.24 and earlier)
 Mitigation: Update UniFi Play PowerAmp to Version 1.0.38 or later
 Update UniFi Play Audio Port  to Version 1.1.9 or later

Action-Not Available
Vendor-Ubiquiti Inc.
Product-UniFi Play Audio PortUniFi Play PowerAmp
CWE ID-CWE-284
Improper Access Control
CVE-2026-22562
Matching Score-8
Assigner-HackerOne
ShareView Details
Matching Score-8
Assigner-HackerOne
CVSS Score-9.8||CRITICAL
EPSS-0.77% / 51.99%
||
7 Day CHG~0.00%
Published-13 Apr, 2026 | 21:28
Updated-30 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A malicious actor with access to the UniFi Play network could exploit a Path Traversal vulnerability found in the device firmware to write files on the system that could be used for a remote code execution (RCE). Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier)
UniFi Play Audio Port  (Version 1.0.24 and earlier)
 Mitigation: Update UniFi Play PowerAmp to Version 1.0.38 or later
Update UniFi Play Audio Port  to Version 1.1.9 or later

Action-Not Available
Vendor-Ubiquiti Inc.
Product-UniFi Play Audio PortUniFi Play PowerAmp
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2023-35085
Matching Score-8
Assigner-HackerOne
ShareView Details
Matching Score-8
Assigner-HackerOne
CVSS Score-9||CRITICAL
EPSS-0.74% / 50.94%
||
7 Day CHG~0.00%
Published-10 Aug, 2023 | 18:58
Updated-04 Dec, 2024 | 16:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An integer overflow vulnerability in all UniFi Access Points and Switches, excluding the Switch Flex Mini, with SNMP Monitoring and default settings enabled could allow a Remote Code Execution (RCE). Affected Products: All UniFi Access Points (Version 6.5.50 and earlier) All UniFi Switches (Version 6.5.32 and earlier) -USW Flex Mini excluded. Mitigation: Update UniFi Access Points to Version 6.5.62 or later. Update the UniFi Switches to Version 6.5.59 or later.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-usw-pro-24usw-pro-24-poeus-48-500wusw-flex-xgusw-enterprisexg-24ubb-xgusw-flexu6-lrunifi_switch_firmwareus-16-150wusw-lite-16-poeus-xg-6poeu6-extenderus-8-150wusw-48-poeuap-ac-prou6\+usw-enterprise-24-poeusw-industrialusw-48usw-pro-48-poeusw-24us-8-60wusw-enterprise-8-poeu6-prouap-ac-liteu6-iwuwb-xguap-ac-musw-aggregationusw-lite-8-poeu6-enterpriseusw-24-poeuap-ac-iwu6-liteunifi_uap_firmwareusw-mission-criticalusw-pro-48u6-meshuap-ac-m-prousw-16-poeusw-pro-aggregationus-24-250wubbuap-ac-lru6-enterprise-iwusw-enterprise-48-poeUniFi Access PointsUniFi Switches
CWE ID-CWE-190
Integer Overflow or Wraparound
CVE-2026-54402
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-9.9||CRITICAL
EPSS-1.18% / 64.55%
||
7 Day CHG+0.31%
Published-02 Jul, 2026 | 14:49
Updated-10 Jul, 2026 | 02:49
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-unas_pro_firmwareunifi_dream_wall_firmwareunifi_network_video_recorder_instantunifi_cloud_gateway_ultraunifi_dream_router_7unas_pro_4unifi_cloud_gateway_max_firmwareunifi_cloudkeyunifi_cloudkey_enterpriseunifi_network_video_recorder_pro_firmwareunifi_dream_machine_pro_firmwareunas_4_firmwareunifi_dream_routerunifi_cloud_key_plus_firmwareunifi_network_video_recorderunifi_cloudkey_firmwareenterprise_network_video_recorder_coreunas_proenterprise_network_video_recorderenterprise_network_video_recorder_firmwareunifi_os_serverunas_pro_4_firmwareunifi_dream_machine_proenterprise_network_video_recorder_core_firmwareunifi_network_video_recorder_firmwareenterprise_firewall_coreunifi_network_video_recorder_g2_firmwareunifi_dream_machine_firmwareunifi_dream_machine_beastunifi_dream_router_7_firmwareunifi_network_video_recorder_g2unifi_cloud_gateway_industrial_firmwareunas_2unifi_dream_machine_pro_max_firmwareunifi_dream_router_5g_max_firmwareunifi_network_video_recorder_prounifi_dream_wallunifi_dream_router_5g_maxunifi_cloud_gateway_ultra_firmwareenterprise_firewall_core_firmwareunifi_network_video_recorder_g2_prounifi_dream_machineunifi_network_video_recorder_instant_firmwareunifi_express_7_firmwareenterprise_fortress_gatewayenterprise_fortress_gateway_firmwareunifi_express_7unas_4unifi_cloud_gateway_maxunifi_dream_machine_special_edition_firmwareunifi_cloud_gateway_industrialunifi_cloud_gateway_fiberunifi_cloud_key_plusunifi_dream_router_firmwareunifi_dream_machine_pro_maxunifi_network_video_recorder_g2_pro_firmwareunifi_dream_machine_beast_firmwareunifi_dream_machine_special_editionunifi_cloud_gateway_fiber_firmwareunas_2_firmwareunas_pro_8unifi_cloudkey_enterprise_firmwareunas_pro_8_firmwareEnterprise Video RecordersDream MachinesExpress 7Cloud KeysUniFi OS ServerNetwork Video RecordersCloud GatewaysDream WallNetwork Attached StorageEnterprise Firewall CoreDream RoutersEnterprise Fortress Gateway
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2026-47370
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-9.9||CRITICAL
EPSS-0.83% / 53.91%
||
7 Day CHG~0.00%
Published-12 Jun, 2026 | 02:27
Updated-13 Jun, 2026 | 03:55
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to execute a Command Injection within such UniFi OS devices or instances.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-UNVR-G2ENVR-CoreUCK-EnterpriseExpress 7UDM-SEENVREFGUDR7UDWUNVRUDR-5GUDM-ProUNAS-Pro-4UDRUniFi OS ServerUNAS-2UCG-UltraUDM-Pro-MaxUNAS-4UCKExpressUNVR-InstantUNVR-ProUCG-MaxUDMUDM-BeastUNAS-Pro-8UNAS-ProUNVR-G2-ProUCKPUCG-FiberUCG-Industrial
CWE ID-CWE-20
Improper Input Validation
CVE-2026-54405
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-7.5||HIGH
EPSS-0.34% / 26.47%
||
7 Day CHG+0.08%
Published-02 Jul, 2026 | 14:49
Updated-02 Jul, 2026 | 17:50
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Denial of Service (DoS) attack on the application.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-unifi_network_applicationUniFi Network Application
CWE ID-CWE-20
Improper Input Validation
CVE-2026-50748
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-9.9||CRITICAL
EPSS-1.21% / 65.18%
||
7 Day CHG+0.32%
Published-02 Jul, 2026 | 14:49
Updated-09 Jul, 2026 | 13:21
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-unifi_access_applicationUniFi Access Application
CWE ID-CWE-20
Improper Input Validation
CVE-2026-47369
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-9.9||CRITICAL
EPSS-0.30% / 22.59%
||
7 Day CHG~0.00%
Published-12 Jun, 2026 | 02:27
Updated-13 Jun, 2026 | 03:55
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-UNVR-G2ENVR-CoreUCK-EnterpriseExpress 7UDM-SEENVREFGUDR7UDWUNVRUDR-5GUDM-ProUNAS-Pro-4UDRUniFi OS ServerUNAS-2UCG-UltraUDM-Pro-MaxUNAS-4UCKExpressUNVR-InstantUNVR-ProUCG-MaxUDMUDM-BeastUNAS-Pro-8UNAS-ProUNVR-G2-ProUCKPUCG-FiberUCG-Industrial
CWE ID-CWE-20
Improper Input Validation
CVE-2026-47367
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-9.9||CRITICAL
EPSS-0.83% / 53.64%
||
7 Day CHG~0.00%
Published-12 Jun, 2026 | 02:27
Updated-12 Jun, 2026 | 16:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Command Injection on the host device.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-UID Enterprise Agent
CWE ID-CWE-20
Improper Input Validation
CVE-2025-48978
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-7.5||HIGH
EPSS-0.67% / 48.21%
||
7 Day CHG-0.02%
Published-21 Aug, 2025 | 00:01
Updated-22 Aug, 2025 | 18:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch adjacent network. Affected Products: EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) Mitigation: Update the EdgeMAX EdgeSwitch to Version 1.11.1 or later.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-EdgeMAX EdgeSwitch
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2025-48979
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-3.4||LOW
EPSS-0.44% / 35.94%
||
7 Day CHG~0.00%
Published-28 Aug, 2025 | 23:07
Updated-29 Aug, 2025 | 16:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privileges and local access.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-UISP Application
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2026-22559
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-8.8||HIGH
EPSS-0.36% / 28.44%
||
7 Day CHG+0.04%
Published-24 Mar, 2026 | 19:05
Updated-30 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An Improper Input Validation vulnerability in UniFi Network Server may allow unauthorized access to an account if the account owner is socially engineered into clicking a malicious link. Affected Products: UniFi Network Server (Version 10.1.85 and earlier) Mitigation: Update UniFi Network Server to Version 10.1.89 or later.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-UniFi Network Server
CWE ID-CWE-20
Improper Input Validation
CVE-2026-34910
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-10||CRITICAL
EPSS-86.96% / 99.73%
||
7 Day CHG+8.40%
Published-22 May, 2026 | 00:43
Updated-23 Jul, 2026 | 16:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Known KEV||Action Due Date - 2026-06-26||Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-unas_pro_firmwareunifi_dream_wall_firmwareunifi_network_video_recorder_instantunifi_cloud_gateway_ultraunifi_dream_router_7unas_pro_4unifi_cloud_gateway_max_firmwareunifi_cloudkeyunifi_network_video_recorder_pro_firmwareunifi_cloudkey_enterpriseunifi_dream_machine_pro_firmwareunas_4_firmwareunifi_dream_routerenterprise_network_video_recorder_coreunifi_network_video_recorderunifi_cloud_key_plus_firmwareunifi_cloudkey_firmwareunas_proenterprise_network_video_recorderenterprise_network_video_recorder_firmwareunifi_os_serverunas_pro_4_firmwareunifi_dream_machine_proenterprise_network_video_recorder_core_firmwareunifi_network_video_recorder_firmwareunifi_network_video_recorder_g2_firmwareunifi_dream_machine_firmwareunifi_dream_machine_beastunifi_dream_router_7_firmwareunifi_network_video_recorder_g2unifi_cloud_gateway_industrial_firmwareunas_2unifi_dream_machine_pro_max_firmwareunifi_dream_router_5g_max_firmwareunifi_network_video_recorder_prounifi_dream_wallunifi_dream_router_5g_maxunifi_cloud_gateway_ultra_firmwareunifi_network_video_recorder_g2_prounifi_dream_machineunifi_network_video_recorder_instant_firmwareunifi_express_7_firmwareenterprise_fortress_gatewayenterprise_fortress_gateway_firmwareunifi_express_7unas_4unifi_cloud_gateway_maxunifi_dream_machine_special_edition_firmwareunifi_cloud_gateway_industrialunifi_cloud_gateway_fiberunifi_cloud_key_plusunifi_dream_router_firmwareunifi_dream_machine_pro_maxunifi_network_video_recorder_g2_pro_firmwareunifi_dream_machine_beast_firmwareunifi_dream_machine_special_editionunifi_cloud_gateway_fiber_firmwareunas_2_firmwareunas_pro_8unifi_cloudkey_enterprise_firmwareunas_pro_8_firmwareUNVR-G2UniFi OS ServerUNAS-2ENVR-CoreUCG-UltraUDM-Pro-MaxUNAS-4UCKUNVR-InstantUCK-EnterpriseUCG-MaxUNVR-ProUDMExpress 7UDM-SEENVRUDM-BeastEFGUDR7UNAS-Pro-8UDWUNVRUNAS-ProUDR-5GUNVR-G2-ProUCKPUCG-FiberUDM-ProUNAS-Pro-4UDRUCG-IndustrialUniFi OS
CWE ID-CWE-20
Improper Input Validation
CVE-2026-33000
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-9.1||CRITICAL
EPSS-1.25% / 66.27%
||
7 Day CHG+0.13%
Published-22 May, 2026 | 00:43
Updated-23 Jul, 2026 | 16:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-unifi_os_serverUniFi OS Server
CWE ID-CWE-20
Improper Input Validation
CVE-2026-22565
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-7.5||HIGH
EPSS-0.43% / 35.43%
||
7 Day CHG~0.00%
Published-13 Apr, 2026 | 21:28
Updated-30 Apr, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An Improper Input Validation vulnerability could allow a malicious actor with access to the UniFi Play network to cause the device to stop responding.
 Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier)
 UniFi Play Audio Port  (Version 1.0.24 and earlier)
 Mitigation: Update UniFi Play PowerAmp to Version 1.0.38 or later
 Update UniFi Play Audio Port  to Version 1.1.9 or later

Action-Not Available
Vendor-Ubiquiti Inc.
Product-UniFi Play Audio PortUniFi Play PowerAmp
CWE ID-CWE-20
Improper Input Validation
CVE-2026-21639
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-5.4||MEDIUM
EPSS-0.27% / 18.85%
||
7 Day CHG~0.00%
Published-08 Jan, 2026 | 16:14
Updated-14 Jan, 2026 | 21:06
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product. Affected Products: airMAX AC (Version 8.7.20 and earlier) airMAX M (Version 6.3.22 and earlier) airFiber AF60-XG (Version 1.2.2 and earlier) airFiber AF60 (Version 2.6.7 and earlier) Mitigation: Update your airMAX AC to Version 8.7.21 or later. Update your airMAX M to Version 6.3.24 or later. Update your airFiber AF60-XG to Version 1.2.3 or later. Update your airFiber AF60 to Version 2.6.8 or later.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-airmax_acairfiber_af60airmax_ac_firmwareairfiber_af60_firmwareairmax_mairfiber_af60-xgairfiber_af60-xg_firmwareairmax_m_firmwareairFiber AF60-XGairMAX ACairFiber AF60airMAX M
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2026-21638
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-8.8||HIGH
EPSS-0.38% / 30.90%
||
7 Day CHG~0.00%
Published-08 Jan, 2026 | 16:14
Updated-26 Feb, 2026 | 15:04
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product. Affected Products: UBB-XG (Version 1.2.2 and earlier) UDB-Pro/UDB-Pro-Sector (Version 1.4.1 and earlier) UBB (Version 3.1.5 and earlier) Mitigation: Update your UBB-XG to Version 1.2.3 or later. Update your UDB-Pro/UDB-Pro-Sector to Version 1.4.2 or later. Update your UBB to Version 3.1.7 or later.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-udb-pro-sector_firmwareubbubb-xgubb_firmwareudb-proubb-xg_firmwareudb-pro_firmwareudb-pro-sectorUBB-XGUBBUDB-Pro/UDB-Pro-Sector
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2025-27211
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-7.5||HIGH
EPSS-0.58% / 44.34%
||
7 Day CHG~0.00%
Published-04 Aug, 2025 | 22:12
Updated-05 Aug, 2025 | 14:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch adjacent network.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-EdgeMAX EdgeSwitch
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2025-23119
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-7.5||HIGH
EPSS-0.72% / 50.19%
||
7 Day CHG~0.00%
Published-01 Mar, 2025 | 01:52
Updated-15 Apr, 2026 | 00:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An Improper Neutralization of Escape Sequences vulnerability could allow an Authentication Bypass with a Remote Code Execution (RCE) by a malicious actor with access to UniFi Protect Cameras adjacent network.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-UniFi Protect Cameras
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2024-42025
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-7.8||HIGH
EPSS-0.79% / 52.48%
||
7 Day CHG~0.00%
Published-13 Sep, 2024 | 15:47
Updated-28 Sep, 2024 | 18:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and earlier) allows a malicious actor with unifi user shell access to escalate privileges to root on the host device.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-unifi_network_applicationUniFi Network Applicationunifi_network_application
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2024-22054
Matching Score-6
Assigner-HackerOne
ShareView Details
Matching Score-6
Assigner-HackerOne
CVSS Score-7.5||HIGH
EPSS-0.52% / 40.85%
||
7 Day CHG~0.00%
Published-20 Feb, 2024 | 17:14
Updated-15 Apr, 2026 | 00:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery. Affected Products: UniFi Access Points UniFi Switches UniFi LTE Backup UniFi Express (Only Mesh Mode, Router mode is not affected) Mitigation: Update UniFi Access Points to Version 6.6.55 or later. Update UniFi Switches to Version 6.6.61 or later. Update UniFi LTE Backup to Version 6.6.57 or later. Update UniFi Express to Version 3.2.5 or later.

Action-Not Available
Vendor-Ubiquiti Inc.
Product-UniFi Access PointsUniFi SwitchesUniFi Express UniFi LTE Backupunifi_uap_firmware
CWE ID-CWE-20
Improper Input Validation
CVE-2024-21488
Matching Score-4
Assigner-Snyk
ShareView Details
Matching Score-4
Assigner-Snyk
CVSS Score-7.3||HIGH
EPSS-3.27% / 87.12%
||
7 Day CHG~0.00%
Published-30 Jan, 2024 | 05:00
Updated-26 Jul, 2026 | 15:25
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.

Action-Not Available
Vendor-forkhqn/a
Product-networknetworkorg.webjars.npm:network
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2025-67728
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.60% / 45.14%
||
7 Day CHG~0.00%
Published-12 Dec, 2025 | 07:10
Updated-22 Dec, 2025 | 19:05
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Fireshare Public Uploads feature is vulnerable to OS Command Injection (RCE)

Fireshare facilitates self-hosted media and link sharing. Versions 1.2.30 and below allow an authenticated user, or unauthenticated user if the Public Uploads setting is enabled, to craft a malicious filename when uploading a video file. The malicious filename is then concatenated directly into a shell command, which can be used for uploading files to arbitrary directories via path traversal, or executing system commands for Remote Code Execution (RCE). This issue is fixed in version 1.3.0.

Action-Not Available
Vendor-shaneisraelShaneIsrael
Product-firesharefireshare
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2026-9384
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-9.3||CRITICAL
EPSS-1.73% / 75.27%
||
7 Day CHG~0.00%
Published-24 May, 2026 | 13:30
Updated-23 Jul, 2026 | 11:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument ip results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used.

Action-Not Available
Vendor-TOTOLINK
Product-A8000RU
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-66219
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-6.9||MEDIUM
EPSS-2.47% / 82.80%
||
7 Day CHG~0.00%
Published-29 Nov, 2025 | 01:34
Updated-19 Dec, 2025 | 15:52
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
willitmerge has a command Injection vulnerability

willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public.

Action-Not Available
Vendor-dontkryshama
Product-willitmergewillitmerge
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2026-9458
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-9.3||CRITICAL
EPSS-2.09% / 79.71%
||
7 Day CHG~0.00%
Published-25 May, 2026 | 12:30
Updated-23 Jul, 2026 | 11:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument enabled leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used.

Action-Not Available
Vendor-TOTOLINK
Product-A8000RU
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2021-1275
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-9.8||CRITICAL
EPSS-2.07% / 79.39%
||
7 Day CHG~0.00%
Published-06 May, 2021 | 12:50
Updated-08 Nov, 2024 | 23:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cisco SD-WAN vManage Software Vulnerabilities

Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privileges or gain unauthorized access to the application. For more information about these vulnerabilities, see the Details section of this advisory.

Action-Not Available
Vendor-Cisco Systems, Inc.
Product-sd-wan_vmanagecatalyst_sd-wan_managerCisco SD-WAN vManage
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-400
Uncontrolled Resource Consumption
CVE-2026-9435
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-9.3||CRITICAL
EPSS-1.91% / 77.64%
||
7 Day CHG~0.00%
Published-25 May, 2026 | 06:45
Updated-23 Jul, 2026 | 11:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setQosCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument enable results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

Action-Not Available
Vendor-TOTOLINK
Product-A8000RU
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-9408
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-9.3||CRITICAL
EPSS-1.73% / 75.27%
||
7 Day CHG~0.00%
Published-25 May, 2026 | 00:00
Updated-23 Jul, 2026 | 11:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injection

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setStaticDhcpRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument enable results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.

Action-Not Available
Vendor-TOTOLINK
Product-A8000RU
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-9476
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-9.3||CRITICAL
EPSS-1.91% / 77.64%
||
7 Day CHG~0.00%
Published-25 May, 2026 | 17:00
Updated-23 Jul, 2026 | 11:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument admpass leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used.

Action-Not Available
Vendor-TOTOLINK
Product-A8000RU
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-9455
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-9.3||CRITICAL
EPSS-1.91% / 77.64%
||
7 Day CHG~0.00%
Published-25 May, 2026 | 11:45
Updated-23 Jul, 2026 | 11:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument FileName leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

Action-Not Available
Vendor-TOTOLINK
Product-A8000RU
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-9406
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-9.3||CRITICAL
EPSS-1.73% / 75.27%
||
7 Day CHG~0.00%
Published-24 May, 2026 | 23:30
Updated-23 Jul, 2026 | 11:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setRemoteCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

Action-Not Available
Vendor-TOTOLINK
Product-A8000RU
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-9434
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-9.3||CRITICAL
EPSS-1.73% / 75.27%
||
7 Day CHG~0.00%
Published-25 May, 2026 | 06:30
Updated-23 Jul, 2026 | 11:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setWiFiWpsCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument wscDisabled leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

Action-Not Available
Vendor-TOTOLINK
Product-A8000RU
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-52027
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-1.67% / 74.36%
||
7 Day CHG~0.00%
Published-11 Jan, 2024 | 00:00
Updated-17 Jun, 2025 | 16:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the NTPSyncWithHost function.

Action-Not Available
Vendor-n/aTOTOLINK
Product-a3700r_firmwarea3700rn/a
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2023-52042
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.95% / 57.59%
||
7 Day CHG~0.00%
Published-16 Jan, 2024 | 00:00
Updated-30 Aug, 2024 | 19:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue discovered in sub_4117F8 function in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the 'lang' parameter.

Action-Not Available
Vendor-n/aTOTOLINK
Product-x6000rx6000r_firmwaren/ax6000r_firmware
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2025-6618
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-5.3||MEDIUM
EPSS-2.69% / 84.29%
||
7 Day CHG~0.00%
Published-25 Jun, 2025 | 17:31
Updated-27 Jun, 2025 | 18:20
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
TOTOLINK CA300-PoE wps.so SetWLanApcliSettings os command injection

A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been classified as critical. Affected is the function SetWLanApcliSettings of the file wps.so. The manipulation of the argument PIN leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Action-Not Available
Vendor-TOTOLINK
Product-ca300-poeca300-poe_firmwareCA300-PoE
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-6621
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-5.3||MEDIUM
EPSS-2.70% / 84.34%
||
7 Day CHG~0.00%
Published-25 Jun, 2025 | 18:00
Updated-27 Jun, 2025 | 18:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
TOTOLINK CA300-PoE ap.so QuickSetting os command injection

A vulnerability classified as critical has been found in TOTOLINK CA300-PoE 6.2c.884. This affects the function QuickSetting of the file ap.so. The manipulation of the argument hour/minute leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Action-Not Available
Vendor-TOTOLINK
Product-ca300-poeca300-poe_firmwareCA300-PoE
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-66259
Matching Score-4
Assigner-Gridware Cybersecurity
ShareView Details
Matching Score-4
Assigner-Gridware Cybersecurity
CVSS Score-9.3||CRITICAL
EPSS-0.65% / 47.17%
||
7 Day CHG+0.06%
Published-26 Nov, 2025 | 00:46
Updated-03 Dec, 2025 | 16:50
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Authenticated Root Remote Code Execution through improper filtering of HTTP post request parameters

Authenticated Root Remote Code Execution via improrer user input filtering in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform in main_ok.php user supplied data/hour/time is passed directly into date shell command

Action-Not Available
Vendor-dbbroadcastDB Electronica Telecomunicazioni S.p.A.
Product-mozart_dds_next_7000mozart_dds_next_6000_firmwaremozart_next_6000mozart_next_1000_firmwaremozart_dds_next_300_firmwaremozart_dds_next_500_firmwaremozart_next_500mozart_dds_next_500mozart_next_3500_firmwaremozart_dds_next_7000_firmwaremozart_next_7000_firmwaremozart_next_2000mozart_next_300mozart_dds_next_1000_firmwaremozart_next_100mozart_dds_next_3500mozart_dds_next_50mozart_next_100_firmwaremozart_dds_next_30mozart_dds_next_3500_firmwaremozart_next_50_firmwaremozart_dds_next_3000mozart_dds_next_3000_firmwaremozart_next_1000mozart_next_30mozart_next_50mozart_dds_next_2000mozart_dds_next_300mozart_dds_next_100mozart_dds_next_6000mozart_next_7000mozart_next_300_firmwaremozart_dds_next_100_firmwaremozart_next_3500mozart_next_3000_firmwaremozart_dds_next_30_firmwaremozart_dds_next_2000_firmwaremozart_next_6000_firmwaremozart_dds_next_50_firmwaremozart_next_500_firmwaremozart_next_30_firmwaremozart_dds_next_1000mozart_next_3000mozart_next_2000_firmwareMozart FM Transmitter
CWE ID-CWE-20
Improper Input Validation
CVE-2023-52040
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.85% / 54.48%
||
7 Day CHG~0.00%
Published-24 Jan, 2024 | 00:00
Updated-02 Aug, 2024 | 22:48
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function.

Action-Not Available
Vendor-n/aTOTOLINK
Product-x6000rx6000r_firmwaren/ax6000r_firmware
CWE ID-CWE-253
Incorrect Check of Function Return Value
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2026-9433
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-9.3||CRITICAL
EPSS-1.73% / 75.27%
||
7 Day CHG~0.00%
Published-25 May, 2026 | 06:15
Updated-23 Jul, 2026 | 11:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument enable causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Action-Not Available
Vendor-TOTOLINK
Product-A8000RU
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-50983
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-2.01% / 78.79%
||
7 Day CHG~0.00%
Published-20 Dec, 2023 | 00:00
Updated-09 Jul, 2026 | 01:18
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function.

Action-Not Available
Vendor-n/aTenda Technology Co., Ltd.
Product-i29_firmwarei29n/a
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2025-67484
Matching Score-4
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-4
Assigner-The Wikimedia Foundation
CVSS Score-Not Assigned
EPSS-0.40% / 32.21%
||
7 Day CHG~0.00%
Published-03 Feb, 2026 | 01:24
Updated-14 Apr, 2026 | 13:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Action API xslt option allows JavaScript execution by administrators who are not interface administrators

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

Action-Not Available
Vendor-Wikimedia Foundation
Product-mediawikiMediaWiki
CWE ID-CWE-20
Improper Input Validation
CVE-2026-9478
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-9.3||CRITICAL
EPSS-1.91% / 77.64%
||
7 Day CHG~0.00%
Published-25 May, 2026 | 17:30
Updated-23 Jul, 2026 | 11:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Action-Not Available
Vendor-TOTOLINK
Product-A8000RU
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  • Previous
  • 1
  • 2
  • 3
  • ...
  • 32
  • 33
  • Next
Details not found