CVE-2026-54404

A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine_beast:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:ui:enterprise_fortress_gateway_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:enterprise_fortress_gateway:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:ui:unifi_dream_router_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_router:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:ui:unifi_dream_wall_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_wall:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:ui:unifi_dream_router_7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_router_7:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:ui:unifi_express_7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_express_7:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloudkey:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:ui:unifi_cloud_key_plus_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_key_plus:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:ui:unifi_cloudkey_enterprise_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloudkey_enterprise:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:ui:unifi_network_video_recorder_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:ui:unifi_network_video_recorder_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder_pro:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:ui:unifi_network_video_recorder_instant_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder_instant:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:enterprise_network_video_recorder:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:enterprise_network_video_recorder_core:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:ui:unifi_network_video_recorder_g2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder_g2:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:ui:unifi_network_video_recorder_g2_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder_g2_pro:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:ui:unifi_cloud_gateway_ultra_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_gateway_ultra:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_gateway_max:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_gateway_industrial:-:*:*:*:*:*:*:*

Configuration 20 (hide)

AND
cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_gateway_fiber:-:*:*:*:*:*:*:*

Configuration 21 (hide)

AND
cpe:2.3:o:ui:unas_2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unas_2:-:*:*:*:*:*:*:*

Configuration 22 (hide)

AND
cpe:2.3:o:ui:unas_4_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unas_4:-:*:*:*:*:*:*:*

Configuration 23 (hide)

AND
cpe:2.3:o:ui:unas_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unas_pro:-:*:*:*:*:*:*:*

Configuration 24 (hide)

AND
cpe:2.3:o:ui:unas_pro_4_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unas_pro_4:-:*:*:*:*:*:*:*

Configuration 25 (hide)

AND
cpe:2.3:o:ui:unas_pro_8_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unas_pro_8:-:*:*:*:*:*:*:*

Configuration 26 (hide)

AND
cpe:2.3:o:ui:enterprise_firewall_core_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:enterprise_firewall_core:-:*:*:*:*:*:*:*

Configuration 27 (hide)

cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:*

Configuration 28 (hide)

AND
cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine:-:*:*:*:*:*:*:*

Configuration 29 (hide)

AND
cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:*

Configuration 30 (hide)

AND
cpe:2.3:o:ui:unifi_dream_machine_special_edition_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine_special_edition:-:*:*:*:*:*:*:*

Configuration 31 (hide)

AND
cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine_pro_max:-:*:*:*:*:*:*:*

Configuration 32 (hide)

AND
cpe:2.3:o:ui:unifi_dream_router_5g_max_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_router_5g_max:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-07-02 15:17

Updated : 2026-07-10 02:48


NVD link : CVE-2026-54404

Mitre link : CVE-2026-54404

CVE.ORG link : CVE-2026-54404


JSON object : View

Products Affected

ui

  • unifi_express_7_firmware
  • enterprise_fortress_gateway
  • unifi_network_video_recorder_pro
  • enterprise_network_video_recorder
  • unifi_cloud_gateway_max
  • unifi_network_video_recorder_g2_pro_firmware
  • unifi_cloud_key_plus
  • unifi_network_video_recorder_g2_firmware
  • unifi_network_video_recorder_g2
  • unifi_dream_wall
  • unas_pro_4
  • enterprise_firewall_core
  • unas_pro_8
  • unifi_network_video_recorder_firmware
  • unifi_dream_machine_pro_max_firmware
  • unifi_dream_machine_beast_firmware
  • unifi_dream_router_5g_max_firmware
  • unifi_network_video_recorder_pro_firmware
  • unas_2_firmware
  • unifi_cloudkey_firmware
  • unas_pro_4_firmware
  • unas_pro_firmware
  • unifi_dream_machine_pro_max
  • unifi_dream_machine
  • unifi_cloud_gateway_fiber
  • unifi_dream_machine_beast
  • unifi_cloud_gateway_industrial_firmware
  • unifi_dream_machine_special_edition
  • unifi_cloud_gateway_fiber_firmware
  • enterprise_network_video_recorder_core_firmware
  • enterprise_fortress_gateway_firmware
  • unas_pro_8_firmware
  • unifi_dream_machine_pro
  • unifi_dream_router_7_firmware
  • unifi_cloudkey_enterprise
  • unas_4_firmware
  • unifi_dream_machine_firmware
  • unifi_cloud_key_plus_firmware
  • unifi_cloudkey
  • unifi_dream_router_firmware
  • unas_pro
  • unifi_dream_router_5g_max
  • unifi_express_7
  • unifi_network_video_recorder_instant
  • unifi_dream_wall_firmware
  • enterprise_firewall_core_firmware
  • unifi_network_video_recorder
  • unifi_cloud_gateway_ultra
  • unifi_cloud_gateway_max_firmware
  • unifi_cloudkey_enterprise_firmware
  • enterprise_network_video_recorder_core
  • unifi_network_video_recorder_instant_firmware
  • unas_4
  • enterprise_network_video_recorder_firmware
  • unifi_network_video_recorder_g2_pro
  • unifi_dream_router_7
  • unifi_cloud_gateway_ultra_firmware
  • unifi_cloud_gateway_industrial
  • unifi_dream_machine_pro_firmware
  • unifi_dream_machine_special_edition_firmware
  • unifi_dream_router
  • unifi_os_server
  • unas_2
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')