CVE-2026-54409

A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UniFi Protect Application to bypass authentication in UniFi Protect Cameras.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ui:unifi_protect:*:*:*:*:*:*:*:*

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Un actor malicioso con acceso a la red y bajo ciertas condiciones podría explotar una vulnerabilidad de inicialización incorrecta encontrada en la aplicación UniFi Protect para eludir la autenticación en las cámaras UniFi Protect.

Information

Published : 2026-07-02 15:17

Updated : 2026-10-25 21:10

NVD link : CVE-2026-54409

Mitre link : CVE-2026-54409

CVE.ORG link : CVE-2026-54409

JSON object : View

Products Affected

ui

unifi_protect

CWE

CWE-665

Improper Initialization

{"id": "CVE-2026-54409", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54409", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-02T16:09:56.430776Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "Ubiquiti Inc", "product": "UniFi Protect Application", "versions": [{"status": "affected", "version": "0", "lessThan": "7.1.83", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-02T15:17:04.627", "references": [{"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc", "tags": ["Vendor Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-665"}]}], "descriptions": [{"lang": "en", "value": "A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UniFi Protect Application to bypass authentication in UniFi Protect Cameras."}, {"lang": "es", "value": "Un actor malicioso con acceso a la red y bajo ciertas condiciones podr\u00eda explotar una vulnerabilidad de inicializaci\u00f3n incorrecta encontrada en la aplicaci\u00f3n UniFi Protect para eludir la autenticaci\u00f3n en las c\u00e1maras UniFi Protect."}], "lastModified": "2026-10-25T21:10:00.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ui:unifi_protect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CCB52AC4-8FD0-49B7-A3C2-42BB928906BB", "versionEndExcluding": "7.1.83"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}