CVE-2026-55111

Executive Summary

CVE-2026-55111 is a high-severity Path Traversal vulnerability (CWE-22) affecting UniFi Protect Floodlight devices. An unauthenticated remote attacker with network access can exploit this flaw to read arbitrary files from the device's filesystem, potentially exposing sensitive configuration data and credentials. The vulnerability carries a CVSS score of 7.5 (High) with an attack vector of AV:N, requiring no privileges or user interaction. As of the latest tracking data, no vendor patch is available, and the vulnerability remains unpatched (patch confidence 0/4). All UniFi Protect Floodlight deployments exposed to untrusted networks are at risk and should implement immediate mitigation controls.

Technical Analysis

CVE-2026-55111 is a Path Traversal vulnerability residing in the UniFi Protect Floodlight device's embedded web server or API handler. The flaw stems from insufficient input sanitization in URL-parameter handling, lacking validation of directory traversal sequences such as ../. A malicious actor leveraging a crafted HTTP request can traverse the filesystem and retrieve sensitive files (e.g., /etc/passwd, configuration files, private keys) with the privileges of the application process.

The UniFi Protect Floodlight is an IoT edge device with a lightweight web-based management interface, making the attack surface internet-facing. Evidence suggests the vulnerability exists in an endpoint that accepts filenames as query parameters without validating canonical path resolution. This allows an attacker to supply ../../../../etc/passwd-style payloads. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates remote, low-complexity exploitation with high confidentiality impact; availability and integrity are unaffected.

The attack surface is amplified by the default configuration of many network camera and IoT systems, which often expose management ports to the network. Given that the CWE-22 class of vulnerability is well-understood across the Unifi product line, an attacker requires only standard HTTP tooling to exploit this flaw. The exploitability (EPSS 0.00335) is currently low, but unpatched devices represent a material risk to organizations.

Exploitation Scenarios

The following step-by-step attack chain is representative of a successful exploitation of CVE-2026-55111.

1. Reconnaissance/Identification: The attacker scans the network for UniFi Protect Floodlight devices, typically discovering them on ports 80/443 or via multicast DNS (mDNS). Once identified, the attacker checks the web management interface version to confirm the target is eligible for the attack (i.e., no patch deployed).

2. Weaponization/Trigger: The attacker crafts an HTTP GET request targeting the vulnerable endpoint, injecting path traversal sequences. Example request:

   GET /api/v1/device/config?file=../../../../../../etc/shadow HTTP/1.1
   Host: <floodlight-ip>
   

   The attacker may systematically iterate through traversal depths (../ repeated 1-8 times) to reach the root filesystem.

3. Payload/Execution: The server fails to sanitize the file parameter and returns the contents of the requested sensitive file. Below is a typical response capturing the file body:

   HTTP/1.1 200 OK
   Content-Type: text/plain
   
   root:$6$....shadowhash....:18000:0:99999:7:::
   

   For escalated impact, the attacker can retrieve configuration backups containing WPA2 keys, cloud API credentials, or management certificates.

4. Post-Exploitation Impact: With credentials or authenticated session material in hand, the attacker pivots deeper into the camera network — potentially committing lateral movement to the internal network, deploying malware, or silently monitoring video feeds.

Note: The attack requires only network reachability; no authentication or user interaction is needed, making it highly accessible to a remote threat actor.

Impact Assessment

Based on the CVSS score of 7.5, the impact is categorized as High. The confidentiality component in the CVSS vector is rated High (C:H), meaning a successful exploit leaks sensitive data, which may include hidden operating system files, application secrets, and encryption keys. The attack complexity is Low (AC:L), privileges required is None (PR:N), and user interaction is None (UI:N), indicating a trivially exploitable vulnerability for remote attackers.

Blast radius is primarily confined to the Floodlight device itself and the local network segment. However, any exposed management interface significantly increases the risk, as the attacker can leverage leaked credentials to access other UniFi Protect infrastructure. This could include controller servers, surveillance storage arrays, or adjacent IoT devices sharing the same network trust zones. While the integrity and availability portions of the vector are None (I:N/A:N), the threat persists through subsequent exposure of the credentials.

The lack of a patch, high confidentiality exposure, and potential for lateral movement makes this vulnerability critical for any organization deploying UniFi Protect Floodlights in perimeter or untrusted networks.

Detection Guidance

Sigma Rule

title: UniFi Protect Floodlight Path Traversal Attempt
id: 3d6c9f6d-8f4b-4a62-b4da-9f0c3e9b5511
status: experimental
description: Detects path traversal patterns in HTTP requests to UniFi Protect Floodlight devices.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55111
author: Valtersit Threat Intelligence
date: 2025/09/29
logsource:
    category: webserver
    product: unifi_protect
detection:
    selection:
        http.url|contains:
            - '/api/'
            - 'file='
        http.url|contains|all:
            - '../'
            - 'etc/'
            - '/var/run/'
            - 'shadow'
    condition: selection
level: high
falsepositives:
    - Legitimate system administration activities
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026-55111

YARA Rule

rule CVE_2026_55111_UniFi_Floodlight_PathTraversal {
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2025-09-29"
        description = "Detects path traversal patterns related to CVE-2026-55111"
        cve = "CVE-2026-55111"
    strings:
        $traverse = "..\\"
        $traverse2 = "../"
        $api_param = "file="
        $etc = "/etc/"
        $shadow = "shadow"
        $proc = "/proc/self/"
    condition:
        any of ($traverse*) and any of ($etc, $shadow, $proc)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-55111 - Unifi Floodlight Path Traversal Attempt"; flow:established,to_server; content:"GET"; http_method; content:"/api/"; http_uri; content:"file="; http_uri; nocase; pcre:"/\/api\/.*file=.*\.\.\//Ui"; classtype:attempted-recon; sid:202655111; rev:1;)

Elastic Detection

sequence by host.name with maxspan=5s
  [ any where
    event.module == "http" and
    process.name == "floodlight_web" and
    http.request.body.text : "*../*" or
    url.path : "*file=*../*"
  ]

Splunk SPL Query

index=web sourcetype=unifi:protect
| search "file=*" "/api/" 
| regex _raw = "\.\./\.\./.*(etc|var|shadow)"
| eval severity="HIGH_CVE_2026_55111"
| table _time, src_ip, dest_ip, uri_path, status, method
| sort - _time

Wazuh OSSEC Rule

<group name="unifi_protect,">
  <rule id="551111" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.\./</field>
    <description>CVE-2026-55111 - Potential Unifi Floodlight path traversal exploitation</description>
    <group>cve_2026_55111,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. The vendor has not released a firmware update for this vulnerability; immediate strategic mitigations are required.

1. Immediate Mitigations:

   • Restrict network access to the Floodlight device's management interface. Place it behind a strict firewall and disallow external inbound access from the internet.
   • Disable the web-based management interface if physically possible; configure via a wired serial console instead.
   • Deploy network segmentation to isolate IoT devices from production LAN segments.

2. Patch/Upgrade Steps:

   • No patched firmware version is currently available from the vendor. Monitor vendor advisory channels for a patched release and apply it as soon as it is distributed. Until then, assume the device is exposed.
   • If a vendor-supplied update cannot be applied, consider compensating controls (reverse proxy with signature-based inspection) as a temporary measure.

3. Long-Term Hardening:

   • Implement application-level positive allowlists for HTTP parameters through WAF or reverse proxy rules.
   • Rotate all credentials and keys exposed from affected devices once the device is patched or retired.
   • Review continuous detection measures for anomalous GET /api/*file=* patterns and false-positive tuning.

References

• NVD – CVE-2026-55111: https://nvd.nist.gov/vuln/detail/CVE-2026-55111
• Vendor Security Advisory (pending): https://www.ui.com/security
• CWE-22 Path Traversal Reference: https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK – T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Note: No threat actor campaigns or exploit-in-the-wild evidence has been publicly observed for this CVE; however, the low EPSS percentile (26.1%) indicates the vulnerability is not yet widely weaponized. CISA KEV does not currently list this CVE, so it is not subject to a federal binding operational directive.