CVE-2026-34909

Published: May 22, 2026Modified: Jul 23, 2026CISA KEV

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: support@hackerone.com (Secondary)

Description

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.

Affected (32)

32 products

Unifi Os Server

Unifi Cloud Gateway Industrial Firmware

Unifi Dream Machine Firmware

Unifi Dream Machine Pro Firmware

Unifi Dream Machine Special Edition Firmware

Unifi Dream Machine Pro Max Firmware

Enterprise Fortress Gateway Firmware

Unifi Dream Wall Firmware

Unifi Dream Router Firmware

Unifi Dream Router 7 Firmware

Unifi Express 7 Firmware

Unifi Network Video Recorder Firmware

Unifi Network Video Recorder Pro Firmware

Unifi Network Video Recorder Instant Firmware

Enterprise Network Video Recorder Firmware

Unifi Cloud Gateway Ultra Firmware

Unifi Cloud Gateway Max Firmware

Unifi Cloud Gateway Fiber Firmware

Unifi Dream Router 5g Max Firmware

Enterprise Network Video Recorder Core Firmware

Unifi Cloud Key Plus Firmware

Unifi Cloudkey Firmware

Unifi Cloudkey Enterprise Firmware

Unifi Network Video Recorder G2 Firmware

Unifi Network Video Recorder G2 Pro Firmware

Unifi Dream Machine Beast Firmware

Unifi Express Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ui Unifi Os Server	Before 5.0.8

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Cloud Gateway Industrial Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Cloud Gateway Industrial	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Dream Machine Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Dream Machine	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Dream Machine Pro Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Dream Machine Pro	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Dream Machine Special Edition Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Dream Machine Special Edition	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Dream Machine Pro Max Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Dream Machine Pro Max	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Enterprise Fortress Gateway Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Enterprise Fortress Gateway	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Dream Wall Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Dream Wall	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Dream Router Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Dream Router	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Dream Router 7 Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Dream Router 7	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Express 7 Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Express 7	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Network Video Recorder Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Network Video Recorder	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Network Video Recorder Pro Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Network Video Recorder Pro	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Network Video Recorder Instant Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Network Video Recorder Instant	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Enterprise Network Video Recorder Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Enterprise Network Video Recorder	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Cloud Gateway Ultra Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Cloud Gateway Ultra	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Cloud Gateway Max Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Cloud Gateway Max	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Cloud Gateway Fiber Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Cloud Gateway Fiber	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Dream Router 5g Max Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Dream Router 5g Max	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Enterprise Network Video Recorder Core Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Enterprise Network Video Recorder Core	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Cloud Key Plus Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Cloud Key Plus	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Cloudkey Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Cloudkey	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Cloudkey Enterprise Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Cloudkey Enterprise	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Network Video Recorder G2 Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Network Video Recorder G2	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Network Video Recorder G2 Pro Firmware	Before 5.1.12

Running on/with	Platform Versions
Ui Unifi Network Video Recorder G2 Pro	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Dream Machine Beast Firmware	Before 5.1.11

Running on/with	Platform Versions
Ui Unifi Dream Machine Beast	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unas 2 Firmware	Before 5.1.10

Running on/with	Platform Versions
Ui Unas 2	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unas 4 Firmware	Before 5.1.10

Running on/with	Platform Versions
Ui Unas 4	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unas Pro Firmware	Before 5.1.10

Running on/with	Platform Versions
Ui Unas Pro	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unas Pro 4 Firmware	Before 5.1.10

Running on/with	Platform Versions
Ui Unas Pro 4	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unas Pro 8 Firmware	Before 5.1.10

Running on/with	Platform Versions
Ui Unas Pro 8	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Unifi Express Firmware	Before 4.0.14

Running on/with	Platform Versions
Ui Unifi Express	All versions

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (3)

https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b

Source: support@hackerone.com

PatchVendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34909

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.