CVE-2026-77535

Executive Summary

CVE-2026-77535 is an unpatched, high-severity (CVSS 9.1) Improper Input Validation vulnerability (CWE-20) in Ubiquiti's UniFi Network Application. A malicious actor with network access and high privileges (required for controller management access) can exploit this flaw to achieve Command Injection (OWASP category A03:2021) on any device adopted by the UniFi controller. Successful exploitation results in full remote code execution (RCE) on affected network devices (APs, switches, gateways) with the privileges of the device's management daemon, leading to a full compromise of the network infrastructure. The attack requires prior authentication at a high-privilege level (e.g., Super Admin / Owner), but the impact is escalated because it allows pivoting from the controller to every adopted device, making lateral movement trivial. As of this report, there is no patch, no public exploit, and no evidence of active exploitation in the wild.

Technical Analysis

The vulnerability resides in the UniFi Network Application (the Java-based controller software, historically provided as a downloadable JAR or integrated into UniFi OS on the Cloud Key / Dream Machine lines). The NVD description identifies the root cause as "Improper Input Validation" (CWE-20), which leads to "Command Injection."

Mechanism (class-level):

1. Input Source: The application receives management commands from an authenticated high-privilege user (e.g., through the web UI, REST API, or internal websocket/STUN channels used for device adoption commands). The description states the actor must have "access to the network and high privileges" — this means a Super Admin account on the controller, or logical equivalent, is required.
2. Flaw Trigger: Certain fields intended for device configuration, provisioning scripts, or custom properties (e.g., site settings, device names, SNMP community strings, or custom shell commands for services) are concatenated into a command string that is executed on the adopted device's underlying OS shell without adequate sanitization.
3. Execution: The crafted input breaks out of the intended argument context and appends arbitrary OS commands. Because the UniFi device agent (informant) runs with root/administrator privileges on the device, the injected commands execute with maximum privileges on the target hardware.
4. Blast Radius: Because the controller manages hundreds or thousands of devices, a single crafted configuration push from the controller can propagate the injection to all adopted devices simultaneously, turning a single high-privilege account compromise into full network infrastructure takeover.

Attack Surface:

• The UniFi Network Application (web portal/login and REST API endpoint).
• Device provisioning channel (adoption procedures using the inform protocol over STUN/websockets).
• The management interface on the adopted device (SSH, if enabled, or the CLI through SSH).

Insufficient technical detail: The NVD description does not specify the exact parameter names, endpoints (e.g., /api/s/default/set/...), or Java class names. We therefore refrain from fabricating specific code paths. The attack surface is nonetheless clearly defined by the industry-standard architecture of UniFi.

Exploitation Scenarios

Preconditions (from CVSS and description):

• Network access to the UniFi controller (AV:N).
• High privileges (PR:H) — a valid Super Admin-level account on the controller web UI or API.
• No user interaction (UI:N).
• The target device(s) must be "adopted" — i.e., actively connected and managed by the controller.

Attack Chain (inferred from vulnerability class; no public PoC available):

1. Reconnaissance / Target Identification: The attacker identifies an exposed UniFi Network Application via Shodan or internet-wide scanning (default port 8443 for web UI, UDP 3478/STUN for device communication). Alternatively, the attacker compromises a low-privilege controller account or steals a Super Admin session token via phishing/credential stuffing.

2. Authentication & Trigger: Attacker logs in with high-privilege credentials. They navigate to a device configuration page (or API endpoint) that allows setting device-level parameters (e.g., device name, location, or "custom configuration" fields). The target field is the vulnerable input that is improperly validated.

3. Payload Execution: The attacker injects a command like $(malicious_command) or appends ; malicious_command into the input field (exact payload pattern unknown — class-level description only). The controller passes this string verbatim to the adopted device's management daemon, which builds a shell command. The injected command executes on the device's OS, e.g., to drop a web shell, establish a reverse SSH tunnel, or install a cryptominer. Note: This is a vulnerability-class inference; exact payload syntax cannot be confirmed without PoC.

4. Post-Exploitation: The attacker has root on the adopted device. They can:

   • Exfiltrate network credentials (e.g., VPN PSKs, WPA keys).
   • Facilitate lateral movement into the LAN beyond the device.
   • Use the compromised device as a pivot proxy to reach internal servers.
   • Deploy persistent implants (CWE-20 → RCE → persistence). With high CVSS scope change (S:C), compromise extends beyond the controller/device to the connected infrastructure.

Threat Actor Considerations: As of this writing, no known threat actor group is associated with this CVE in public reporting. Exploit-in-the-wild evidence: None.

Impact Assessment

CVSS Subscore Analysis (9.1):

• Attack Vector (AV:N): Exploitable remotely from any network position of the controller.
• Attack Complexity (AC:L): Low — no race conditions or special conditions beyond authentication.
• Privileges Required (PR:H): High — requires Super Admin or equal—this is the mitigating factor; however, the consequence of a compromised admin account is catastrophic because of the scope change.
• User Interaction (UI:N): None.
• Scope (S:C): Critical — a successful attack moves beyond the controller's security boundary into the managed device infrastructure.
• Confidentiality/Integrity/Availability (H/H/H): Full loss of device credentials, firmware integrity alteration, and denial of service via device bricking.

Business Impact:

• Affected Systems: All devices running Ubiquiti's UniFi Network Application (controller software on Linux/Windows/macOS or UniFi OS on Cloud Key, Dream Machine, and Network Video Recorders) and all adopted UniFi access points, switches, and gateways managed by the controller.
• Blast Radius: The adoption model means the controller orchestrates configuration pushes to every device. A single crafted push can compromise the entire fleet simultaneously. If the attacker replaces device firmware, recovery requires physical access to each device (or remotely re-flashing from the compromised controller, which is not trustworthy).
• Integrity: Attacker can manipulate firewall rules, VLAN configurations, and traffic routing — effectively controlling the network perimeter.
• Availability: A malicious device config can factory-reset all devices, taking down the entire network (DoS).

Financial Impact: High recovery cost (field technician visits for device reflashing), brand reputation damage for managed service providers (MSPs) running UniFi for small-to-medium enterprise clients.

Detection Guidance

Detection of this vulnerability is hindered by the pre-authentication requirement (high-privilege). Detection should focus on anomalous controller-to-device command pushes and unusual device behavior post-adoption.

Sigma Rule

title: CVE-2026-77535 - UniFi Command Injection via High-Privilege Config Push
id: 5f8c9e2a-3f64-4b1a-9c7d-2e5a6b7c8d9e
status: experimental
description: Detects abnormal configuration push commands to adopted UniFi devices containing shell metacharacters.
logsource:
  product: unifi_controller
  category: device_config
detection:
  selection:
    log.type: device_config_change
    fields.device_id: 
      - '*'
    fields.config_value|contains:
      - ';'
      - '&&'
      - '||'
      - '`'
      - '$('
      - '|'
  filter_known_good:
    fields.config_name|contains:
      - 'device_name'
      - 'site_name'
  condition: selection and not filter_known_good
level: high
falsepositives:
  - Legitimate custom firmware provisioning scripts that use shell syntax in custom fields.
tags:
  - attack.t1600.001
  - attack.t1190
  - cve.2026.77535

YARA Rule

rule CVE_2026_77535_UniFi_CommandInjection_Payload
{
    meta:
        author = "Valters IT Threat Intel"
        date = "2026-06-15"
        description = "Detects common command injection payload patterns in UniFi device configuration strings pushed from controller."
        severity = "critical"
        reference = "CVE-2026-77535"
    strings:
        $s1 = "$(whoami)" ascii
        $s2 = "$(id" ascii
        $s3 = ";nc -e /bin/sh" ascii
        $s4 = "&cmd.exe /c" ascii
        $s5 = "$(/usr/bin/id" ascii
        $s6 = "|sh" ascii
        $s7 = "`id`" ascii
    condition:
        any of them and (filesize < 5MB)
}

Suricata IDS Rule

alert http any any -> $UNIFI_CONTROLLER any (msg:"CVE-2026-77535 - Potential Command Injection in UniFi Config Push"; flow:to_server,established; content:"POST"; http_method; content:"/api/s/"; http_uri; pcre:"/\$\(.*\)|;\s*\w+\s+.*|&&.*&&|\|.*sh|\`.*\`/i"; sid:202677535; rev:1; metadata:attack_target_server, cve CVE-2026-77535, tag network_infrastructure;)

Elastic Detection

// Elastic EQL rule for UniFi controller logs (if ingested via Filebeat)
sequence by host.name with maxspan=5m
  [ any where process.name == "unifi" and process.command_line : ("*;*", "*&&*", "*|sh*", "*$(*", "*`*") ]
  [ any where event.action : ("device_config_saved", "device_config_apply") ]

Splunk SPL Query

index=unifi sourcetype="unifi:events"
| search "device_config" OR "adopt" OR "apply_config"
| regex _raw="(?i)(\$(\(|\{|[A-Z0-9_])|;\s*(sh|bash|nc|wget|curl|chmod|/bin/)|&&|\|\|)"
| stats count by src_ip, dest_ip, user, command, _time
| where count > 2
| sort - _time

Wazuh OSSEC Rule

<group name="unifi,">
  <rule id="699076" level="12">
    <decoded_as>json</decoded_as>
    <field name="type">^device_config_change$</field>
    <regex>(\$(\(|\{)|;\s*[a-z]+ |&&|\|\||`)</regex>
    <description>CVE-2026-77535 - Unifi controller pushed config with command injection patterns</description>
    <mitre>
      <id>T1600.001</id>
      <id>T1190</id>
    </mitre>
    <group>attack_recon,attack.execution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor patch exists as of this writing.

1. Immediate Mitigations (No Patch Available):

• Restrict Network Exposure: Do NOT expose the UniFi controller web UI (port 8443) directly to the internet. Place it behind a VPN or firewall allow-list, and disable the "Remote Access" feature in UniFi (which proxies the UI publicly).
• Enforce MFA: Require multi-factor authentication for all controller admin accounts. Since the attack requires PR:H, an account with MFA enabled is harder to compromise.
• Review High-Privileged Accounts: Audit all Super Admin accounts. Remove any stale accounts. Enable SSO with conditional access policies.
• Disable Remote Device SSH (if not needed): In the controller settings, disable SSH access to adopted devices. This reduces the post-exploitation persistence options.
• Network Segmentation: Place adopted devices on a dedicated management VLAN with no direct internet access (only to the controller). This cuts off the attacker's option to use compromised devices to phone home to C2.

2. Patch/Upgrade Steps:

• Subscribe to Ubiquiti's security advisory email list and monitor the UniFi Network release notes.
• Apply a firmware/software update immediately when Ubiquiti publishes a fix (watch for release notes mentioning CWE-20 or command injection).
• Do not adopt devices from untrusted networks, as the poisoning could originate from the device side.

3. Long-Term Hardening:

• Implement the principle of least privilege: Use a "Site Admin" role with limited scopes only when absolutely needed; restrict Super Admin to a few named individuals.
• Enable detailed audit logging on the controller and push logs to a SIEM (e.g., via the Splunk add-on or Wazuh).
• For MSPs: implement MSSP-style monitoring of the Unifi controller events (login failures, config push patterns).
• Consider hardware-level protection: enable "Reboot on failed adoption" and periodic device firmware integrity checks.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-77535 (mitre.org references available at time of publication).
2. Ubiquiti Community / Security Advisories: https://community.ui.com/releases (expected vendor advisory pending patch release).
3. CWE-20 Database: https://cwe.mitre.org/data/definitions/20.html
4. FIRST EPSS: Not yet scored by FIRST.org (EPSS score pending release).
5. CISA KEV: Not currently listed (no known exploitation in the wild).

Threat Actor Intelligence: No known active campaigns or exploit-in-the-wild evidence as of June 2026. The implicit credential requirement (PR:H) limits mass exploitation, but highly targeted attacks targeting managed service providers that run UniFi controllers are plausible given the high impact per single credential.