Vulnerabilidades em Ubiquiti Inc
81 resultadosAnálise Vexday
Com 3 CVEs confirmadas em exploração ativa no catálogo CISA KEV, a Ubiquiti Inc apresenta uma taxa de exploração 11,9 vezes acima da média geral, o que indica histórico desproporcional de vulnerabilidades efetivamente aproveitadas por agentes maliciosos. Das 56 CVEs catalogadas, 22 são classificadas como críticas, e 15 surgiram nos últimos 90 dias, sugerindo ritmo acelerado de descoberta recente que merece acompanhamento contínuo. O tipo de falha mais frequente é CWE-20 (validação inadequada de entrada), padrão que tende a viabilizar diferentes classes de ataque quando não mitigado sistematicamente. A CVE-2026-34910 se destaca como a ameaça ativa mais grave no momento, com EPSS de 0,7856 — valor que indica alta probabilidade de exploração —, e deve ser tratada com prioridade máxima por equipes que operam equipamentos Ubiquiti.
CVE-2025-23119HIGHAn Improper Neutralization of Escape Sequences vulnerability could allow an Authentication Bypass with a Remote Code Execution (RCE) by a maEPSS 0.7%CVE-2025-23115CRITICALA Use After Free vulnerability on UniFi Protect Cameras could allow a Remote Code Execution (RCE) by a malicious actor with access to UniFi EPSS 0.7%CVE-2026-34911HIGHA malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to acEPSS 0.7%CVE-2025-48978HIGHAn Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) could allow a Command Injection by a malicious actor with acEPSS 0.7%CVE-2026-54403HIGHA malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypasEPSS 0.6%CVE-2025-27211HIGHAn Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with acEPSS 0.6%CVE-2026-22558HIGHAn Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor with authenticated access toEPSS 0.6%CVE-2026-55115CRITICALA malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect ApplicatEPSS 0.5%CVE-2026-54400CRITICALA malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi AccesEPSS 0.5%CVE-2024-22054HIGHA malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device maEPSS 0.5%CVE-2025-23116CRITICALAn Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor witEPSS 0.5%CVE-2026-50747CRITICALA malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found EPSS 0.5%CVE-2024-29206LOWAn Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported EPSS 0.4%CVE-2026-22565HIGHAn Improper Input Validation vulnerability could allow a malicious actor with access to the UniFi Play network to cause the device to stop rEPSS 0.4%CVE-2025-48979LOWAn Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privileges and local access.EPSS 0.4%CVE-2026-21633HIGHA malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery pEPSS 0.4%CVE-2026-22564CRITICALAn Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauthoriEPSS 0.4%CVE-2026-55116CRITICALA malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerabilityEPSS 0.4%CVE-2026-21638HIGHA malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote EPSS 0.4%CVE-2025-27217CRITICALA Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside oEPSS 0.4%