CVE-2026-77544

Executive Summary

CVE-2026-77544 is a critical out-of-bounds write vulnerability (CWE-787) affecting certain UniFi gateway devices. A remote, unauthenticated attacker with network access to the affected device can trigger memory corruption that results in a denial of service (DoS) condition, rendering the gateway unavailable. With a CVSS base score of 7.5 and no public proof-of-concept, exploit code, or patch currently available, affected organizations face an unmitigated availability risk to network edge infrastructure.

Technical Analysis

The vulnerability is classified as CWE-787 (Out-of-bounds Write). This class of flaw occurs when software writes data past the end of an allocated buffer, corrupting adjacent memory. In the context of a gateway device, such corruption can crash the management or data-plane process, cause a device reboot, or render the device unresponsive — satisfying the availability-only impact described in the NVD entry.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates the following characteristics:

• Attack Vector (Network): The flaw is reachable remotely over the network, consistent with a gateway device exposing services on its interfaces.
• Attack Complexity (Low): No specialized conditions or race windows are required to trigger the flaw.
• Privileges Required (None): No authentication is needed; the attacker need not hold valid credentials.
• User Interaction (None): No victim action is required to trigger the vulnerability.
• Scope (Unchanged): The impact is confined to the vulnerable component.
• Confidentiality/Integrity (None): The disclosed impact is availability-only; the description explicitly characterizes the outcome as a DoS.
• Availability (High): Successful exploitation fully degrades or denies the device's availability.

The attack surface is the network-facing services of the affected UniFi gateway devices. Because out-of-bounds writes typically arise from improper bounds validation on attacker-controlled input (for example, a length field or payload parsed from a network request), the flaw is presumed reachable through one of the device's exposed network-handling code paths.

Important caveat: The NVD description does not disclose the specific protocol, service, port, function, or packet structure involved. No exact vulnerable version range is published, and no vendor advisory detailing the affected firmware builds is available. As a result, the precise input that triggers the out-of-bounds write cannot be stated without fabrication. Affected version enumeration and root-cause specifics should be treated as pending vendor disclosure.

No public exploit code, Nuclei template, or proof-of-concept exists as of this report.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred strictly from the vulnerability class (CWE-787 out-of-bounds write) and the CVSS vector. Specific endpoints, ports, packet fields, or function names are not disclosed in the source data and are intentionally not fabricated.

1. Reconnaissance / Target Identification. An attacker with network access to the target — either on the local network segment or via an exposed management/data interface — identifies UniFi gateway devices. Shodan-style queries such as product:"UniFi" or http.title:"UniFi" can be used to locate internet-exposed instances. The attacker confirms a reachable network-facing service on the device.

2. Triggering the Flaw (Vulnerability-Class Level). Because this is an out-of-bounds write reachable without authentication, the attacker sends a crafted network request to one of the device's exposed services. The request supplies input that, due to insufficient bounds checking, causes data to be written beyond the bounds of an allocated buffer. No credentials are required, matching the PR:N vector.

3. Payload / Execution Method. At the vulnerability-class level, the attacker crafts malformed input whose length or structure exceeds the buffer the device allocates for it. The write corrupts adjacent memory, which — per the published impact — results in a denial-of-service condition. The description does not indicate that the flaw is used for code execution, and the CVSS subscores (C:N/I:N) reflect availability-only impact; therefore the reliable outcome is device disruption or crash rather than remote code execution.

4. Post-Exploitation Impact. Successful triggering renders the gateway unavailable. Depending on device design, this may manifest as a process crash, an automatic reboot, or a device hang. Because gateways sit at network boundaries, loss of availability can disrupt routing, VPN connectivity, firewall enforcement, or centralized management for downstream clients — a denial-of-service condition for the affected network segment.

Impact Assessment

The primary impact is availability loss on affected UniFi gateway devices. The CVSS base score of 7.5 (High) is driven entirely by the Availability subscores: C:N (no confidentiality impact), I:N (no integrity impact), and A:H (high availability impact). The AV:N/PR:N/UI:N combination means the barrier to attempting exploitation is low — an unauthenticated attacker with network reachability can repeatedly attempt to trigger the condition.

Business impact considerations:

• Edge disruption: As gateways mediate traffic between network segments, a DoS can cut off connectivity for dependent users and services.
• Management-plane loss: If the crash affects management services, administrators lose visibility and control over the device during the outage.
• Repeated disruption: Because no patch is available and no workaround is documented, an attacker can repeatedly trigger the condition to sustain an outage.
• Blast radius: Limited to affected UniFi gateway models running the vulnerable firmware; the description does not indicate lateral movement or data compromise. However, availability outages on edge devices can have outsized operational consequences for distributed sites.

No evidence of active exploitation, threat actor campaigns, or CISA KEV listing exists as of this report.

Detection Guidance

Sigma Rule

title: UniFi Gateway Out-of-Bounds Write DoS Attempt (CVE-2026-77544)
id: 3f6c1a90-8b2e-4d77-9c21-6a1e7b0f9d44
status: experimental
description: Detects indicators of abnormal or oversized network requests targeting UniFi gateway services consistent with an out-of-bounds write triggering a DoS condition.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77544
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
logsource:
  category: network_connection
  product: suricata
detection:
  selection_target:
    dst_port:
      - 80
      - 443
      - 8443
      - 8080
  selection_anomaly:
    event_type: alert
    alert_signature|contains:
      - 'UniFi'
      - 'out-of-bounds'
      - 'buffer'
  condition: selection_target and selection_anomaly
falsepositives:
  - Legitimate oversized but well-formed management traffic
level: high

YARA Rule

rule CVE_2026_77544_UniFi_OOB_Write_DoS
{
    meta:
        description = "Detects artifacts or captured request patterns indicative of an out-of-bounds write attempt against UniFi gateway devices (CVE-2026-77544)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77544"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"

    strings:
        $unifi = "UniFi" ascii nocase
        $gw     = "UBNT" ascii nocase
        $poc    = "CVE-2026-77544" ascii nocase

    condition:
        filesize < 2MB and
        (2 of ($unifi, $gw, $poc))
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-77544 Possible UniFi Gateway Out-of-Bounds Write DoS Attempt"; flow:to_server,established; content:"UniFi"; http_header; nocase; threshold:type threshold, track by_src, count 20, seconds 10; classtype:attempted-dos; reference:cve,2026-77544; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-77544; sid:202677544; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where destination.port in (80, 443, 8080, 8443) and
      network.transport == "tcp" and
      url.path != null ]
  [ network where event.action == "denied" or event.outcome == "failure" ]

Splunk SPL Query

index=network sourcetype=suricata OR sourcetype=pan:traffic
| search (dest_port IN (80,443,8080,8443))
| eval is_unifi=if(match(http_user_agent,"(?i)unifi") OR match(dest_host,"(?i)unifi"),1,0)
| stats count values(src_ip) as sources by dest_ip dest_port
| where count > 50
| sort - count

Wazuh OSSEC Rule

<group name="unifi,cve-2026-77544,">
  <rule id="100775" level="12">
    <if_sid>100000</if_sid>
    <field name="dst_port">^(80|443|8080|8443)$</field>
    <match>UniFi|UBNT|out-of-bounds|buffer</match>
    <description>CVE-2026-77544: Possible UniFi gateway out-of-bounds write DoS attempt detected.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Note: The detection content above is generic to the vulnerability class. Because the NVD description does not reveal the specific protocol, port, or request structure, these rules should be tuned once vendor or researcher technical details become available.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, no vendor fix is documented, and no affected version list has been published. The following measures are defensive and are not a substitute for a vendor patch.

1) Immediate mitigations

• Restrict network access to UniFi gateway management and data interfaces to trusted administrative segments only; do not expose management services to the internet.
• Apply firewall or ACL rules to limit which sources can reach the device's exposed services.
• Segment gateways so that a DoS condition cannot cascade to additional network segments.
• Monitor device availability and enable alerting on unexpected reboots, process crashes, or management-plane outages.
• Monitor UniFi and Ubiquiti security channels for an official advisory and firmware release.

2) Patch / upgrade steps

• No fixed version is available as of this report. Until a vendor patch is released, mitigation must rely on network-exposure reduction.
• When Ubiquiti publishes a fixed firmware version, upgrade affected gateways promptly and validate the version against the vendor advisory.

3) Long-term hardening

• Adopt a firmware lifecycle practice that tracks UniFi security advisories and applies updates on a defined cadence.
• Maintain an inventory of network-edge devices and their firmware versions for rapid impact assessment when advisories are published.
• Enforce least-exposure principles on all gateway management interfaces (no public management exposure, strong authentication, restricted source ranges).
• Retain network and availability telemetry to detect recurring DoS attempts and confirm remediation effectiveness.

References

• NVD — CVE-2026-77544: https://nvd.nist.gov/vuln/detail/CVE-2026-77544
• MITRE CWE-787 (Out-of-bounds Write): https://cwe.mitre.org/data/definitions/787.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Ubiquiti Security Advisory Portal (monitor for CVE-2026-77544 advisory): https://community.ui.com/releases
• CISA KEV Catalog (CVE-2026-77544 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public exploit code, proof-of-concept, threat actor campaign, or exploit-in-the-wild evidence has been identified for CVE-2026-77544 as of this report. The CVE is not listed in CISA KEV, and FIRST.org has not yet assigned an EPSS score.