Unifi vulnerability - Critical Security Advisory Bulletin 064

[Davit2005]

Not sure if this has been posted elsewhere, apologies if it has I could not seem to find a post for it

 

https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b

 

Quote

Affected Products:

UniFi OS Server (Version 5.0.6 and earlier)

 

 

Mitigation:

Update your UniFi OS Server to Version 5.0.8 or later

 

Impact:

CVSS v3.0 Severity and Metrics:

Base Score: 9.1 Critical

Vector: 

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-33000 (V3rlust)

 

[ZeroHour]

There was also a whole bunch of Score 10 ones last week for their appliances.

[DrCheese]

 

 

Looks like some of these are being exploited in the wild 

[nicholab]

All updated as of Saturday here, also moved to UOS for the hosted application.

[ZeroHour]

UI really need to send an email out for high CVE score alerts to account holders as a lot wont have auto updates turned on and Shodan will make it easier to target. 

[Jobos]

1 hour ago, ZeroHour said:

UI really need to send an email out for high CVE score alerts to account holders as a lot wont have auto updates turned on and Shodan will make it easier to target. 

I agree.

 

[ZeroHour]

Rebump in case anyone missed this during half term.