Ubiquiti Patches Maximum-Severity Critical Vulnerability in UniFi OS

Ubiquiti has released security updates for its UniFi OS operating system, fixing seven critical vulnerabilities. One of them received the highest severity rating.

The core of the problem

The most serious of the patched vulnerabilities can be exploited for command injection attacks — the insertion of arbitrary commands into the system. Such attacks let an attacker execute commands on the vulnerable device without proper authorization.

The remaining six vulnerabilities are also rated critical, though the advisory does not disclose details about them.

The vendor's response

Ubiquiti released updates addressing all seven vulnerabilities and urged users to update UniFi OS to the current version as soon as possible.

Equipment running UniFi OS is widely used in network infrastructure — from home routers to enterprise solutions — so the presence of critical vulnerabilities, especially ones allowing command injection, poses a serious risk to users who fail to install updates in time.

The company did not specify whether any cases of these vulnerabilities being exploited in real-world attacks were recorded before the patch was released.

Source: Bleeping Computer