Full Report
Ubiquiti has released security patches for three new maximum-severity vulnerabilities that threat actors can exploit remotely without privileges. [...]
Analysis Summary
# Vulnerability: Multiple Maximum-Severity Flaws in Ubiquiti UniFi Ecosystem
## CVE Details
- **CVE ID:** CVE-2026-77537
- **CVSS Score:** 10.0 (Critical/Maximum)
- **CWE:** CWE-20 (Improper Input Validation)
- **CVE ID:** CVE-2026-77550
- **CVSS Score:** 10.0 (Critical/Maximum)
- **CWE:** CWE-93 (Improper Neutralization of CRLF Sequences / CRLF Injection)
- **CVE ID:** CVE-2026-77554
- **CVSS Score:** 10.0 (Critical/Maximum)
- **CWE:** CWE-20 (Improper Input Validation / Command Injection)
## Affected Systems
- **Products:**
- UniFi Protect Application (Video surveillance management)
- UniFi OS Devices and Server instances
- UniFi Talk Application (VoIP phone system)
- **Versions:**
- UniFi Protect: Versions prior to 7.2.105
- UniFi Talk: Versions prior to 5.3.2
- UniFi OS Server: Versions 5.1.21 and earlier
- **Configurations:** Systems exposed to the network/internet; specifically those where unauthenticated remote access is possible.
## Vulnerability Description
1. **CVE-2026-77537 (UniFi Protect):** An improper input validation flaw allows an unauthenticated remote attacker to compromise the application.
2. **CVE-2026-77550 (UniFi OS):** A CRLF (Carriage Return Line Feed) injection vulnerability allows attackers to inject malicious sequences into network responses, leading to a complete authentication bypass on the OS level.
3. **CVE-2026-77554 (UniFi Talk):** A command injection flaw caused by improper input validation, allowing attackers to execute unauthorized commands on the VoIP system.
## Exploitation
- **Status:** No confirmed "in the wild" exploitation reported for these specific IDs yet, but historical precedent for similar Ubiquiti flaws suggests high interest from threat actors.
- **Complexity:** Low (No user interaction required).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Total compromise of surveillance data and OS credentials).
- **Integrity:** High (Ability to inject commands and modify system settings).
- **Availability:** High (Potential for full system takeover or disruption).
## Remediation
### Patches
Ubiquiti recommends updating to the following versions (or later) immediately:
- **UniFi Protect Application:** 7.2.105
- **UniFi Talk Application:** 5.3.2
- **UniFi OS Server:** Versions newer than 5.1.21
### Workarounds
- **Network Isolation:** Ensure UniFi management interfaces are not exposed directly to the public internet. Use VPNs or ACLs to restrict access to trusted administrative IPs only.
- **Disable Unused Services:** Disable UniFi Talk or Protect if they are not actively required for operations.
## Detection
- **Indicators of Compromise:**
- Unexpected administrative user creation or credential changes.
- Unusual CRLF sequences or shell metacharacters in HTTP logs.
- Unexplained outbound traffic from UniFi controllers (potential botnet activity).
- **Detection Methods:**
- Audit UniFi OS logs for unauthorized login events.
- Use vulnerability scanners to verify version numbers against the patched releases.
## References
- **Vendor Advisory:** hxxps[://]community[.]ui[.]com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9
- **Censys Tracking:** hxxps[://]platform[.]censys[.]io/search/report/data/table?q=%28host.services.endpoints.http.html_title%3A+%22UniFi+OS%22%29
- **CVE Records:**
- hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-77537
- hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-77550
- hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-77554