{"id": "CVE-2026-55112", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55112", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-02T15:41:29.812778Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "Ubiquiti Inc", "product": "Dream Machines", "versions": [{"status": "affected", "version": "0", "lessThan": "5.1.19", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Ubiquiti Inc", "product": "Dream Wall", "versions": [{"status": "affected", "version": "0", "lessThan": "5.1.19", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Ubiquiti Inc", "product": "Dream Routers", "versions": [{"status": "affected", "version": "0", "lessThan": "5.1.19", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Ubiquiti Inc", "product": "Cloud Keys", "versions": [{"status": "affected", "version": "0", "lessThan": "5.1.19", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Ubiquiti Inc", "product": "Network Video Recorders", "versions": [{"status": "affected", "version": "0", "lessThan": "5.1.19", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Ubiquiti Inc", "product": "Enterprise Video Recorders", "versions": [{"status": "affected", "version": "0", "lessThan": "5.1.19", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Ubiquiti Inc", "product": "Cloud Gateways", "versions": [{"status": "affected", "version": "0", "lessThan": "5.1.19", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-02T15:17:05.103", "references": [{"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc", "tags": ["Vendor Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi OS with UniFi Protect Application to escalate privileges on the host device."}], "lastModified": "2026-07-10T02:46:09.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "629B14D2-94A8-4C0F-9844-DCCC75B76904", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B493983E-8632-4492-9B0A-E8E11E0E0BB2"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_dream_machine_special_edition_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04FEA48A-5115-4857-9EBE-C76C26B92FFA", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_dream_machine_special_edition:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DEF52155-86F1-458A-8B7E-355B67C5C819"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC6ED125-277D-45E8-81E9-2F33ED713258", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_dream_machine_pro_max:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "60808A48-C41A-448F-97C4-B1CD8DCCB4DA"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C404F220-CC40-4CE2-A0CF-13D9F53FA5FD", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_dream_machine_beast:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "82A0A6D7-4361-49AD-87E3-3FB32A958C4E"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_dream_router_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12856016-3F9D-43EA-98E8-CA7C1134CD5D", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_dream_router:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B1FF6A5E-A223-4F57-9FFD-F2AE473B3627"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_dream_wall_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45BB62B2-C27D-4D58-8528-C4F28C8936DE", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_dream_wall:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A9B6514E-2878-4AEE-BF1E-08B804C069FE"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_dream_router_7_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E604718-E38D-4AB8-B76E-3C9B2339F7A9", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_dream_router_7:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A41E5541-FC13-430C-BDCA-CC677B372D7F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ECE501C5-1BFC-4DF1-A56D-4A5B2BF2F58C", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_cloudkey:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A484BC77-24D3-423F-AC16-3341C3396BA1"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_network_video_recorder_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3AFF8A43-D4FF-4193-9DAB-23463E6E731C", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A5D7AF0C-CF50-485D-8471-9AB1AA6471CA"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_network_video_recorder_pro_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C8006E8-54C0-4F4C-9346-92367ED3A57C", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_network_video_recorder_pro:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "87FB08DA-35EA-4C27-AA5F-2B7AE25D58FA"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_network_video_recorder_instant_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "879FD15D-4886-4DF9-A959-C37059FFF4FF", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_network_video_recorder_instant:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FC8EB74F-F32A-4A5E-B613-58F2F7BC24CB"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86106709-F803-4ED1-A738-85E5A9D1114A", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:enterprise_network_video_recorder:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "348BBC75-CA5B-4B38-A2CF-28313B7168F5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75B77A46-2B11-42E7-A624-2CFD9BD66576", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:enterprise_network_video_recorder_core:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BD22580F-1E63-48F0-BE9C-1EA9328DD539"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_network_video_recorder_g2_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE4972F7-C1BD-48C2-ABC3-E1E806CDD4D2", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_network_video_recorder_g2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E1FF59AE-F5F6-4539-97EC-5157F67FD055"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_network_video_recorder_g2_pro_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0E87293-981C-402A-B3A4-2342A72F48A3", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_network_video_recorder_g2_pro:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "29A3E3E6-68EF-43E6-9AB3-AD52FCADE57F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E7D32DF-0FE0-40F1-BC46-53A38A1275F0", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_cloud_gateway_max:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "022225AB-7AF9-4F7A-97A2-CD8700DEA087"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B75FEA76-3EEC-41AF-973B-5E7E06DBC3FB", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_cloud_gateway_industrial:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "ABDECBF6-CB92-4AF6-A3AB-D4AA4635B688"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BC859E7-4839-41E1-B891-01D6C768737E", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_cloud_gateway_fiber:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "01C00466-E414-4DF7-8752-93D3D77C5104"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ui:unifi_dream_router_5g_max_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1446B7B-E5D2-44E4-B4C5-742E882D114C", "versionEndIncluding": "5.1.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:unifi_dream_router_5g_max:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EA957B87-E4D2-4B7C-AC27-200BFC44477E"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "support@hackerone.com"}
