Vulnerabilidades em Ubiquiti Inc
123 resultadosAnálise Vexday
Com 3 CVEs confirmadas em exploração ativa no catálogo CISA KEV, a Ubiquiti Inc apresenta uma taxa de exploração 11,9 vezes acima da média geral, o que indica histórico desproporcional de vulnerabilidades efetivamente aproveitadas por agentes maliciosos. Das 56 CVEs catalogadas, 22 são classificadas como críticas, e 15 surgiram nos últimos 90 dias, sugerindo ritmo acelerado de descoberta recente que merece acompanhamento contínuo. O tipo de falha mais frequente é CWE-20 (validação inadequada de entrada), padrão que tende a viabilizar diferentes classes de ataque quando não mitigado sistematicamente. A CVE-2026-34910 se destaca como a ameaça ativa mais grave no momento, com EPSS de 0,7856 — valor que indica alta probabilidade de exploração —, e deve ser tratada com prioridade máxima por equipes que operam equipamentos Ubiquiti.
CVE-2026-119250HIGHA malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFimanEPSS 0.3%CVE-2025-59467HIGHA Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation EPSS 0.3%CVE-2026-55110HIGHA malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration EPSS 0.3%CVE-2026-77532HIGHA malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwiEPSS 0.3%CVE-2026-110457LOWA malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi ProtecEPSS 0.3%CVE-2026-48610HIGHUnder certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability found EPSS 0.3%CVE-2026-110456MEDIUMA malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UnEPSS 0.3%CVE-2026-110458LOWA malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi ProtecEPSS 0.3%CVE-2026-110459HIGHA malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain EPSS 0.3%CVE-2025-27215HIGHAn Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsuEPSS 0.3%CVE-2026-110454MEDIUMA malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access EPSS 0.3%CVE-2025-27213MEDIUMAn Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug BEPSS 0.2%CVE-2025-52663HIGHA vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This iEPSS 0.2%CVE-2025-23117MEDIUMAn Insufficient Firmware Update Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras aEPSS 0.2%CVE-2026-116837HIGHA malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarEPSS 0.2%CVE-2025-23091MEDIUMAn Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-EPSS 0.2%CVE-2026-116836HIGHA malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulneraEPSS 0.2%CVE-2025-24289HIGHA Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1.3.4 and earlierEPSS 0.2%CVE-2025-23118MEDIUMAn Improper Certificate Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras adjacent EPSS 0.2%CVE-2024-42028HIGHA Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and eaEPSS 0.2%