CVE-2026-77556

Executive Summary

CVE-2026-77556 is an out-of-bounds read (CWE-125) vulnerability affecting certain UniFi gateway devices. A remote, unauthenticated attacker with network access can trigger the flaw to cause a denial-of-service (DoS) condition on the affected device. With a CVSS base score of 7.5 (High) and no patch, public PoC, or vendor advisory currently tracked, the primary risk is availability disruption of UniFi gateway devices that are reachable from untrusted networks.

Technical Analysis

The vulnerability is classified as CWE-125: Out-of-bounds Read. According to the NVD description, the flaw resides in "certain UniFi gateway devices" and can be triggered by "a malicious actor with access to the network." Successful exploitation results in a denial-of-service (DoS) condition on the device.

An out-of-bounds read occurs when software reads data past the end (or before the beginning) of an allocated memory buffer. In network-facing devices such as gateways, such reads typically arise when parsing malformed input — for example, when a length field, offset, or protocol marker in a packet is trusted without validating it against the actual buffer size. When the parser subsequently reads beyond the buffer boundary, the process may crash, hang, or otherwise become unavailable. Because the read is out of bounds rather than a write, the immediate impact is typically a crash or fault (availability loss) rather than memory corruption or code execution — consistent with the CVSS vector, which assigns High impact only to Availability (A:H) and None to Confidentiality and Integrity (C:N/I:N).

The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H:

• AV:N (Network) — the flaw is exploitable remotely over the network.
• AC:L (Low) — no specialized conditions or race windows are required; the attack is repeatable.
• PR:N (None) — no authentication or prior privileges are needed.
• UI:N (None) — no user interaction is required.
• S:U (Unchanged) — the impact is confined to the vulnerable device; no scope change.
• C:N / I:N — no confidentiality or integrity impact is attributed.
• A:H (High) — a total loss of availability of the affected device is possible.

The attack surface is the network-exposed interface(s) of the UniFi gateway. No specific function names, file paths, URL endpoints, or parameter names are provided in the available data. Precisely which parsing routine is affected, and exactly which malformed fields trigger the over-read, are not derivable from the data provided. Any claim to the contrary would be speculation.

The EPSS score has not yet been assigned by FIRST.org, and CISA has not added this CVE to the Known Exploited Vulnerabilities (KEV) catalog. No public proof-of-concept, exploit code, or Nuclei template has been observed at the time of writing. Affected version ranges are not enumerated in the available data.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-125) and the CVSS vector.

1. Reconnaissance / Target Identification. An attacker identifies UniFi gateway devices that are reachable from a network position the attacker controls. This is consistent with AV:N/PR:N — the attacker needs network reachability to an exposed interface but no credentials. Public device-fingerprinting methods (banner, TLS certificate subject, HTTP title, or product identification via internet-scanning services) can be used to locate candidate targets.

2. Triggering the Flaw. Because the vulnerability is an out-of-bounds read reached over the network, the attacker sends specifically crafted input to the vulnerable parsing path on the device. The malformed input causes the parser to read beyond an allocated buffer. The exact protocol, field, packet structure, or interface is not specified in the available data and is therefore not asserted here. At the vulnerability-class level, the trigger is malformed network input whose length/offset characteristics are not validated before a read.

3. Payload / Execution Method. At the class level, no code execution is involved. The "payload" is the malformed network input itself; the objective is to drive the parser into an out-of-bounds read. There is no evidence of memory-write, RCE, or privilege escalation. As with many CWE-125 issues, repeated or specifically-shaped inputs may be required to reliably crash the process (reliability is not specified in the data).

4. Post-Exploitation Impact. The result is a denial-of-service condition on the affected gateway — loss of availability. Per the CVSS profile, there is no confidentiality or integrity impact and no scope change, so downstream compromise of other systems via this flaw alone is not indicated. However, taking a gateway offline can disrupt routing, firewall, VPN, and network segmentation functions for all users behind it, which is a meaningful availability and operational risk even without data compromise.

Impact Assessment

• CVSS Base: 7.5 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
• Primary Impact: Loss of availability (High) of the affected UniFi gateway. No confidentiality or integrity impact is attributed.
• Who Is Affected: Organizations and users operating "certain UniFi gateway devices." The precise model list and version range are not provided in the available data.
• Blast Radius: The direct blast radius is the vulnerable device. Because a gateway commonly serves as the network edge/routing device, an outage can indirectly disrupt all users and services behind it (internet access, inter-VLAN routing, VPN termination, firewall enforcement) — an availability impact that extends beyond the single device in operational terms, though CVSS scores scope as Unchanged.
• Exploit Maturity: Low at present — no public PoC, no exploit code, no Nuclei template, not in CISA KEV, EPSS not yet scored. The immediate likelihood of mass exploitation is therefore uncertain, but the low attack complexity and lack of required authentication mean weaponization is straightforward once the trigger is understood.
• Patch Status: Unpatched per available evidence (Patch Confidence: 0/4). No vendor fix, workaround, or affected-version list is currently tracked.

Detection Guidance

Detection should focus on availability anomalies on UniFi gateway devices and on malformed or anomalous network traffic directed at gateway management/service interfaces. Because the exact trigger is unknown, the rules below target the observable consequences of out-of-bounds-read DoS — service crashes, reboots, and resource exhaustion — plus generic malformed-input patterns. These rules are starting points and should be tuned to the environment.

Sigma Rule

title: Potential UniFi Gateway Denial-of-Service via Out-of-Bounds Read (CVE-2026-77556)
id: 7c1e9b2a-7755-4a01-9b16-7755cve2026
status: experimental
description: Detects symptoms consistent with an availability-impacting out-of-bounds read DoS against UniFi gateway devices, including service crashes and unexpected reboots.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77556
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1499
  - cve.2026-77556
logsource:
  category: system
  product: linux
detection:
  selection_crash:
    - 'program crashed'
    - 'segmentation fault'
    - 'general protection fault'
    - 'out of bounds'
  selection_service:
    - 'ubnt'
    - 'unifi'
    - 'gateway'
  condition: selection_crash and selection_service
falsepositives:
  - Legitimate service restarts during firmware upgrades
  - Unrelated application crashes on non-UniFi systems
level: medium

YARA Rule

rule CVE_2026_77556_UniFi_OOB_Read_DoS
{
    meta:
        description = "Heuristic detection of artifacts/indicators referencing the UniFi gateway out-of-bounds read DoS (CVE-2026-77556)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77556"
        cve = "CVE-2026-77556"
    strings:
        $cve  = "CVE-2026-77556" ascii wide nocase
        $cw   = "CWE-125" ascii wide nocase
        $oob  = "out-of-bounds" ascii wide nocase
        $gw   = "UniFi gateway" ascii wide nocase
    condition:
        any of them
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET any (msg:"CVE-2026-77556 Possible UniFi Gateway Out-of-Bounds Read DoS Attempt"; flow:to_server,established; threshold:type both, track by_src, count 30, seconds 10; classtype:attempted-dos; reference:cve,2026-77556; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-77556; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:2026775560; rev:1;)

Note: A signature targeting the exact trigger cannot be authored without knowledge of the affected protocol/field. The rule above is a rate-based heuristic against repeated traffic toward UniFi gateways; it is not a precise exploit signature.

Elastic Detection

sequence by destination.ip with maxspan=30s
  [network where destination.port in (80, 443, 8443, 8080) and
   network.transport == "tcp" and
   process.name in ("ubnt-", "unifi", "gateway", "nginx")]

The above is an illustrative EQL sequence and should be replaced with an environment-validated sequence once the affected service and interface are confirmed. Operators should prefer EQL rules keyed on repeated connection bursts to the gateway service followed by a service restart or log anomaly.

Splunk SPL Query

index=network sourcetype=firewall OR sourcetype=suricata
| search dest_port IN (80,443,8443,8080)
| stats count AS conn_attempts, dc(src_ip) AS distinct_srcs BY dest_ip, dest_port
| where conn_attempts > 100 AND distinct_srcs <= 3
| sort - conn_attempts

Correlate with device-side crash/reboot logs:

index=syslog ("UniFi" OR "ubnt" OR "gateway") ("segfault" OR "crashed" OR "restart" OR "out of bounds")
| stats count BY host, message

Wazuh OSSEC Rule

<group name="unifi,cve-2026-77556,">
  <rule id="202677556" level="10">
    <decoded_as>syslog</decoded_as>
    <match>UniFi|ubnt|gateway</match>
    <regex>segfault|segmentation fault|out of bounds|service crashed|unexpected restart</regex>
    <description>CVE-2026-77556: Possible UniFi gateway out-of-bounds read denial of service (service crash/restart)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, affected-version list, or workaround has been published in the tracked data. The guidance below is a defensive baseline; it does not substitute for a vendor advisory.

1. Immediate Mitigations

   • Restrict network reachability to UniFi gateway management/service interfaces. Place them behind a firewall, management VLAN, or VPN — do not expose them directly to the internet.
   • Apply ACLs and rate-limiting to limit the volume of untrusted traffic that can reach the device.
   • Monitor affected devices for unexpected restarts, crashes, or service outages that could indicate exploitation.
   • Where feasible, isolate gateway management traffic from user/general network segments.

2. Patch / Upgrade Steps

   • No patch is currently available per tracked evidence. Monitor Ubiquiti's official UniFi security/announcement channels and the NVD entry for CVE-2026-77556 for an updated firmware release.
   • When a vendor fix is published, validate the fix version, test in a staging environment, and roll out across all affected gateways.
   • Maintain an accurate inventory of UniFi gateway models and firmware versions so the fix can be applied promptly once the affected range is confirmed.

3. Long-Term Hardening

   • Adopt a firmware/patch management cadence for network-edge and gateway devices, treating them as critical infrastructure.
   • Enforce network segmentation and least-privilege access to device interfaces.
   • Enable centralized logging, alerting, and availability monitoring for gateways to detect DoS conditions quickly.
   • Subscribe to vendor security bulletins and CISA advisories to track future patches and KEV additions.

References

• NVD — CVE-2026-77556: https://nvd.nist.gov/vuln/detail/CVE-2026-77556
• CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-77556 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (score not yet assigned at time of writing): https://www.first.org/epss/
• Ubiquiti Security Advisories (monitor for the relevant firmware advisory): https://www.ui.com/security-advisories/

No public PoC, exploit code, or threat-actor campaign associated with CVE-2026-77556 has been observed in the available data.