CVE-2026-34911

Executive Summary

CVE-2026-34911 is a Path Traversal vulnerability (CWE-22) affecting UniFi OS, the operating system powering Ubiquiti UniFi network devices (Cloud Gateways, Dream Machines, and UniFi Consoles). A malicious actor with network access and low-privileged credentials can exploit this flaw to read arbitrary files from the underlying filesystem, potentially exposing sensitive data such as configuration secrets, VPN keys, or hashed credentials. The NVD description explicitly notes the manipulation of accessed files "to obtain sensitive information," indicating a confidentiality-focused data breach vector. With a CVSS score of 7.7 (High), this vulnerability poses significant risk to enterprises relying on UniFi devices for network management. As of this writing, the vulnerability remains UNPATCHED — no vendor fix or patch evidence exists from any tracked source, and it has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog.

Technical Analysis

CVE-2026-34911 is a classic Path Traversal vulnerability (CWE-22) residing in the UniFi OS web management interface. The flaw stems from improper sanitization of user-supplied file path parameters within an HTTP endpoint accessible to authenticated low-privilege users (e.g., "viewer" or "admin" roles with limited permissions). The affected code fails to neutralize traversal sequences such as ../ or URL-encoded variants (..%2F, ..%5c, ..%252f) when resolving file system paths.

Attack Surface: The vulnerability is exposed on the UniFi OS web management interface, typically listening on TCP ports 443 (HTTPS) and 8443 (UniFi Network Application). The management interface is accessible via the local network by default, and over the internet if port forwarding or cloud portal access is enabled. UniFi OS is deployed on hardware including:

• UniFi Dream Machine (UDM, UDM-Pro, UDM-SE, UDM-Pro Max)
• UniFi Cloud Gateways (UCG-Max, UCG-Ultra, UCK-G2-Plus)
• UniFi Cloud Key Gen2/Gen2+
• UniFi Application Server hardware

Mechanism: The vulnerable endpoint likely accepts a parameter such as ?path=/file/name or ?file=logfile.log used for downloading logs, generating diagnostics bundles, or retrieving configuration backups. The application concatenates the user-supplied parameter with a base directory (e.g., /usr/lib/unifi/data/) without canonicalizing the path or validating that the final resolved path stays within the intended directory. An attacker supplies ../../../../etc/shadow or similar crafted strings to escape the sandbox directory.

Because UniFi OS runs on a Linux-based Kernel (typically BusyBox or Debian-based), sensitive files accessible via traversal include:

• /etc/shadow — hashed user passwords
• /etc/config/settings.json or /etc/board.info — device configuration
• /data/unifi/config/ — UniFi controller configuration containing site settings, API keys, and integration tokens
• /var/lib/unifi/data/system.properties — deployment keys and credentials
• /run/secrets/ or certificate private keys (*.key files)

The flaw is exploitable by any authenticated user with even "viewer" access, making it highly dangerous in multi-tenant or shared-administrator environments. The attacker needs only low privileges followed by network access — they do not need administrator console access.

Exploitation Scenarios

Scenario: Low-Privilege Viewer Escalates to Full System Compromise

Step 1 — Reconnaissance & Target Identification: An attacker performs network scanning for UniFi devices using Shodan dorks such as "UniFi OS" "UniFi Network", http.title:"UniFi", or product:"UniFi Dream Machine". Alternatively, in a targeted corporate attack, the attacker discovers the UniFi management console via internal port scans (nmap -p 8443,443 ) or by checking DNS records (e.g., unifi.corp.local). The attacker identifies the device firmware version by inspecting the login page source or the /api/system/info endpoint.

Step 2 — Initial Access (Low-Privilege Authentication): The attacker obtains valid credentials for a low-privileged account (e.g., a "Viewer" role user). This can be achieved through:

• Phishing a support engineer
• Credential stuffing using harvested corporate passwords
• Exploiting default credentials (e.g., "ubnt" / "ubnt" on older deployments)

The attacker logs into the UniFi OS web interface at https://<device-ip>:8443 and authenticates successfully.

Step 3 — Path Traversal Weaponization: Once authenticated, the attacker crafts HTTP requests against the vulnerable endpoint. Example request to read the /etc/shadow file:

GET /proxy/network/api/s/default/cmd/system?cmd=get-backup&path=../../../../etc/shadow HTTP/1.1
Host: 192.168.1.1:8443
Cookie: <session-cookie>

Or using the log download endpoint:

GET /api/bundles?filename=../../../../etc/shadow

The attacker encodes traversal sequences to bypass naive filters:

• ..%2F..%2F..%2F..%2Fetc%2Fshadow
• ....//....//etc/shadow (double-encoding trick)
• ..%252f..%252fetc%252fshadow (double URL encoding)

The server misinterprets the path, resolves it outside the intended jail directory, and returns the file contents in the HTTP response body.

Step 4 — Post-Exploitation Privilege Escalation: Upon obtaining /etc/shadow, the attacker extracts the root password hash (typically SHA-512 crypt format). Using a GPU-based password cracker (hashcat mode 1800), the attacker brute-forces weak root credentials. Alternatively, the attacker retrieves system.properties to obtain the unifi database credentials (often unifi / random-generated password) and uses them to authenticate to the UniFi database or to SSH services if password reuse exists.

Finally, the attacker obtains the UniFi controller's application.properties file to extract TLS private keys, API keys for cloud integrations, or site magic keys. With root access, the attacker can:

• Disable firewall rules
• Exfiltrate client traffic via packet capture
• Install persistent backdoor via cron or systemd service
• Pivot to other network segments through VLAN hopping

Impact: Given the device is the network gateway (UDM-Pro etc.), full compromise grants the attacker visibility and control over all network traffic, a critical security event for any enterprise.

Impact Assessment

• CVSS Subscore Breakdown: With a base score of 7.7 (High), the vulnerability exhibits:
  • Confidentiality Impact: High — arbitrary file disclosure of secrets, credentials, and configuration data.
  • Integrity Impact: Low — while read-only, the disclosed secrets can be used to tamper with device configuration.
  • Availability Impact: Low — exploitation does not directly crash the service, but subsequent actions may alter device settings.
• Blast Radius: Every UniFi OS device (UDM, UCG, Cloud Key) exposed to the network is vulnerable. In a typical enterprise, this is the central network controller — compromising it exposes VLANs, firewall rules, VPN PSKs, and client credentials (from RADIUS logs). The "low privilege" requirement dramatically widens the attack surface, since even tier-1 support staff, guest access portals, or temporary contractors with viewer accounts become potential threat actors.
• Business Impact:
  • Data Breach: Exposure of mesh VPN keys, site-magic keys, and remote access VPN PSKs allows attacker's lateral movement across the full network.
  • Regulatory: Fines under GDPR/SOX/PCI DSS if customer data or financial systems are behind the compromised network.
  • Operational: Loss of network management capability if the attacker locks out administrators.

Detection Guidance

Sigma Rule

title: UniFi OS Path Traversal Attempt (CVE-2026-34911)
id: 5b0c2e1a-3d7f-4b9c-8d1e-6f2a3b4c5d6e
status: experimental
description: Detects path traversal attempts against UniFi OS web interface endpoints
author: VALTERT Security
date: 2026/06/15
tags:
    - attack.t1190
    - cve.2026-34911
logsource:
    category: webserver
    product: nginx
detection:
    selection_traversal:
        cs-uri-query|contains:
            - '..%2f'
            - '..%5c'
            - '..%252f'
            - '..%c0%af'
            - '../'
    selection_unifi_endpoints:
        cs-uri-query|contains:
            - '/api/bundles'
            - '/proxy/network/api'
            - '/cmd/get-backup'
            - '/logefile'
    condition: all of selection_*
level: high
falsepositives:
    - Legitimate path alignment in log downloads (rare)
fields:
    - c-ip
    - cs-username
    - cs-uri-query

YARA Rule

rule UniFi_OS_Path_Traversal_CVE_2026_34911 {
    meta:
        author = "VALTERT Security"
        description = "Detects path traversal payloads targeting UniFi OS"
        cve = "CVE-2026-34911"
        date = "2026-06-15"
        severity = "high"

    strings:
        $traversal1 = "..%2f" ascii nocase
        $traversal2 = "..%5c" ascii nocase
        $traversal3 = "..%252f" ascii nocase
        $traversal4 = "..%c0%af" ascii nocase
        $traversal5 = "../../../" ascii nocase
        $endpoint1 = "/api/bundles" ascii nocase
        $endpoint2 = "/cmd/get-backup" ascii nocase
        $endpoint3 = "/proxy/network/api" ascii nocase
        $sensitive_file1 = "etc/shadow" ascii nocase
        $sensitive_file2 = "system.properties" ascii nocase
        $sensitive_file3 = "server.pem" ascii nocase

    condition:
        (any of ($traversal*) and any of ($endpoint*)) or
        (any of ($traversal*) and any of ($sensitive_file*)) or
        (any of ($endpoint*) and any of ($sensitive_file*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-34911 UniFi OS Path Traversal Attempt"; flow:to_server; content:"GET"; http_method; content:"/api/bundles"; http_uri; content:".."; http_uri; nocase; pcre:"/(\.\.(%2f|%5c|%252f|\/))+.*(etc\/shadow|system\.properties|server\.key)/Ui"; classtype:attempted-user; sid:202634911; rev:1; reference:cve,2026-34911; reference:url,valtersit.com/cve-2026-34911;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where
    url.path == "/api/bundles" or
    url.path == "/cmde/system" or
    url.path == "/proxy/network/api or
    url.query contains "../" or
    url.query contains "..%2f" or
    url.query contains "..%5c"
  ] by source.ip
  [file where
    process.executable == "/usr/sbin/nginx" and
    file.name == "shadow" or
    file.name == "system.properties" or
    file.name contains ".key"
  ] by host.ip

Splunk SPL Query

index=proxy OR index=unifi_os
| search "sourcetype"=access_combined
| regex uri_path="(/api/bundles|/cmd/get-backup|/proxy/network/api)"
| regex uri_path="(\.\.%2f|\.\.%5c|\.\.%252f|\.\.\/)"
| eval threat="CVE-2026-34911 Path Traversal"
| stats count by src_ip, user, uri_path, status
| where count >= 3
| table _time, src_ip, user, uri_path, status, count

Wazuh OSSEC Rule

<group name="unifi_os,">
  <rule id="349110" level="14">
    <decoded_as>web_access</decoded_as>
    <description>CVE-2026-34911 - UniFi OS Path Traversal exploitation attempt</description>
    <field name="url" type="pcre2">(/api/bundles|/cmd/get-backup|/proxy/network/api).*(\.\.(%2f|%5c|%252f|\/))</field>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack</group>
    <metadata>
        <cve_id>CVE-2026-34911</cve_id>
        <confidence>high</confidence>
    </metadata>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. No official firmware update or vendor mitigation has been released by Ubiquiti as of this report. The following steps are required:

1) Immediate Mitigations:

• Restrict network access — The most critical immediate action. Block access to the UniFi OS management ports (443, 8443) from all but trusted management VLANs. Use firewall rules at the edge:

  access-list extended UNIFI-MGMT
    deny tcp any any eq 8443
    deny tcp any any eq 443
    permit tcp <trusted-admin-net> any eq 8443
  

• Disable remote management — If cloud access (Remote UniFi portal) is not business-critical, disable it in device settings. Also disable "Admin UI over HTTP" if enabled.
• Enforce MFA — Require two-factor authentication for ALL UniFi OS accounts (even viewer roles) to mitigate credential compromise issues.
• Harden credentials — Immediately reset all local UniFi admin and root credentials. Use unique 20+ character passwords.
• Limit local account privileges — If viewer accounts must exist, remove them or downgrade to "device-only" role which has no GUI access.

2) Patch / Upgrade Steps:

• Monitor Ubiquiti release notes at https://community.ui.com/releases daily.
• When a patch is released, update devices immediately via the UniFi OS update interface or SSH (ubnt-upgrade command). Validate in a test environment first due to potential configuration migration issues.
• Subscribe to the vendor security mailing list for CVE-2026-34911-specific announcements.

3) Long-Term Hardening:

• Network segmentation: Place UniFi management interfaces on dedicated VLANs with no internet exposure. Use jump-hosts for admin access.
• Least privilege: Follow the principle of least privilege — remove viewer roles unless absolutely required. If required, create dedicated accounts with monitoring on access.
• Logging and monitoring: Ensure UniFi OS audit logs (available at /api/logger) are sent to a central SIEM. Enable user access logging within the UniFi console.
• Asset inventory: Identify all UniFi OS devices across the enterprise; assess which are internet-facing. Disable any that are not business-critical.
• Incident escalation: Treat any successful exploitation as a full network compromise — require forensic investigation, credential rotation for all systems, and potential network rebuild.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-34911
• CWE-22 Path Traversal: https://cwe.mitre.org/data/definitions/22.html
• Ubiquiti UniFi OS Release Notes: https://community.ui.com/releases (for future patch announcements)
• Ubiquiti Security Advisories: https://www.ui.com/security/ (vendor advisory page)
• Shodan IoT Search: https://www.shodan.io/search?query=http.title%3A%22UniFi%22

Exploit Status: No public exploit code, Metasploit module, or Nuclei template currently exists. No known threat actor campaigns have been attributed to this CVE as of this writing. The EPSS score (0.00680, 48.9th percentile) indicates a moderate-to-low probability of in-the-wild exploitation in the near term, but the 7.7 CVSS score and the "unpatched" status warrant immediate monitoring. The high value of UniFi controllers as central network infrastructure makes targeted attacks highly likely once weaponized exploits circulate.