A malicious actor with access to the network and high privileges could exploit an Improper Input Validation…

#!/usr/bin/env python3
# verify_cve_2026_33000.py
# Detect likely exposure to CVE-2026-33000 based on UniFi OS Server version.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / detection failure

import argparse
import os
import platform
import re
import subprocess
import sys
from pathlib import Path

VULN_MAX = (5, 0, 6)
PATCH_MIN = (5, 0, 8)
VERSION_RE = re.compile(r'(?<!\d)(\d+)\.(\d+)\.(\d+)(?!\d)')
NAME_HINTS = ('unifi os server', 'unifi-os-server', 'unifi_os_server', 'unifi')

def parse_version(text):
    if not text:
        return None
    m = VERSION_RE.search(text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def fmt(v):
    return '.'.join(str(x) for x in v)


def classify(v):
    if v is None:
        return 'UNKNOWN'
    if v <= VULN_MAX:
        return 'VULNERABLE'
    if v >= PATCH_MIN:
        return 'PATCHED'
    return 'UNKNOWN'  # advisory does not clearly cover 5.0.7


def add_candidate(candidates, source, text):
    v = parse_version(text)
    if v:
        candidates.append((v, source, text.strip()[:200]))


def try_command(candidates, source, cmd):
    try:
        cp = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=5)
        out = cp.stdout or ''
        if any(h in out.lower() for h in NAME_HINTS) or VERSION_RE.search(out):
            add_candidate(candidates, source, out)
    except Exception:
        pass


def scan_paths(candidates, roots):
    interesting_names = (
        'unifi-os-server', 'unifi os server', 'unifi', 'manifest', 'package', 'version',
        'pom.properties', 'Info.plist'
    )
    for root in roots:
        try:
            p = Path(root)
            if not p.exists():
                continue
            for child in p.rglob('*'):
                try:
                    name = child.name.lower()
                    if child.is_dir():
                        add_candidate(candidates, f'path:{child}', str(child))
                        continue
                    if any(k in name for k in interesting_names):
                        add_candidate(candidates, f'file-name:{child}', child.name)
                        if child.stat().st_size <= 262144:
                            try:
                                data = child.read_text(errors='ignore')
                                if 'unifi' in data.lower() or VERSION_RE.search(data):
                                    add_candidate(candidates, f'file-body:{child}', data)
                            except Exception:
                                pass
                except Exception:
                    continue
        except Exception:
            continue


def main():
    ap = argparse.ArgumentParser(description='Check likely exposure to CVE-2026-33000 (UniFi OS Server command injection)')
    ap.add_argument('--version', help='Installed UniFi OS Server version, e.g. 5.0.6')
    ap.add_argument('--path', action='append', default=[], help='Additional path(s) to scan, e.g. /opt or C:\\Program Files')
    args = ap.parse_args()

    candidates = []

    if args.version:
        add_candidate(candidates, 'arg:--version', args.version)

    # Environment hint
    add_candidate(candidates, 'env:UNIFI_OS_SERVER_VERSION', os.environ.get('UNIFI_OS_SERVER_VERSION', ''))

    # Try common commands
    try_command(candidates, 'cmd:podman images', ['podman', 'images'])
    try_command(candidates, 'cmd:docker images', ['docker', 'images'])
    try_command(candidates, 'cmd:ps', ['ps', 'aux'])

    # Common filesystem locations across Linux/macOS/Windows
    roots = list(args.path)
    system = platform.system().lower()
    if 'windows' in system:
        roots += [
            r'C:\Program Files',
            r'C:\Program Files (x86)',
            r'C:\ProgramData',
        ]
    else:
        roots += [
            '/opt',
            '/usr/local',
            '/usr/lib',
            '/var/lib',
            '/Applications',
            str(Path.home()),
            '.',
        ]

    scan_paths(candidates, roots)

    if not candidates:
        print('UNKNOWN - no UniFi OS Server version detected; supply --version <x.y.z> for a deterministic result')
        sys.exit(2)

    # Choose the highest detected version as the safest approximation of installed state.
    candidates.sort(key=lambda x: x[0], reverse=True)
    version, source, snippet = candidates[0]
    verdict = classify(version)

    if verdict == 'VULNERABLE':
        print(f'VULNERABLE - detected UniFi OS Server {fmt(version)} from {source}; Bulletin 064 says 5.0.6 and earlier are affected by CVE-2026-33000')
        sys.exit(1)
    elif verdict == 'PATCHED':
        print(f'PATCHED - detected UniFi OS Server {fmt(version)} from {source}; 5.0.8 or later is the fixed train for CVE-2026-33000')
        sys.exit(0)
    else:
        print(f'UNKNOWN - detected UniFi OS Server {fmt(version)} from {source}; vendor advisory reviewed here does not clearly classify this build (notably 5.0.7)')
        sys.exit(2)

if __name__ == '__main__':
    main()