Ubiquiti UniFiOS: Multiple Vulnerabilities
A BSI Warn- und Informationsdienst (WID): Schwachstellen-Informationen (Bürger Cert) ·
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key insight
The BSI advisory lists neither specific CVE IDs nor evidence of exploitation, so the patch status of affected UniFi controllers must be verified promptly and directly with the vendor.
Description
The BSI reports multiple vulnerabilities in Ubiquiti UniFiOS, without specifying the exact nature or number of the affected components. An attacker can exploit these to execute arbitrary code, escalate privileges, and bypass security measures. Concrete CVE IDs, affected versions, and a CVSS rating are not provided in the advisory. There are no indications of active exploitation in the wild or inclusion in the CISA KEV list. Affected are systems running UniFi controller software.
Risk score
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 0.00
- industry weight
- 1.21
- freshness factor
- 0.50
- exploitability factor
- 1.00
- days old
- 73.00
- vendor mismatch penalty
- 0.00
Path: operational