CVE-2026-54404: UniFi OS SQL Injection Privilege Escalation Vulnerability

Technical summary

CVE-2026-54404 is a series of authenticated SQL injection flaws (CWE-89) in UniFi OS that permit privilege escalation. The vulnerability requires network access and valid low-privilege credentials; an unauthenticated remote attack is not possible. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact across confidentiality, integrity, and availability once an attacker has authenticated. The 'N' in AV indicates network-level accessibility, but the 'L' in PR mandates prior authentication, making this a lateral movement and privilege escalation risk rather than an unauthenticated remote code execution scenario.

Business impact

Organizations deploying UniFi devices as core networking or security infrastructure face elevated risk of insider-initiated or compromised-credential attacks leading to full administrative control. This could enable data exfiltration from managed networks, unauthorized configuration changes, or denial of service. The breadth of affected products—gateways, routers, video recorders, and cloud management appliances—means a single exploited credential could cascade across multiple trust zones. Environments relying on UniFi OS for campus or branch network segmentation should treat this as a priority containment issue.

Affected systems

Ubiquiti UniFi OS running on the following device families: UniFi Dream Machine (Beast variant), UniFi Dream Router (including Gen 7), UniFi Dream Wall, UniFi Express 7, UniFi CloudKey (standard, Plus, and Enterprise editions), Enterprise Fortress Gateway, UniFi Network Video Recorder (standard, Pro, Instant, and Gen 2 variants), Enterprise Network Video Recorder (standard and Core), UniFi Cloud Gateway (Ultra, Max, Industrial, and Fiber variants). Both firmware and hardware variants are affected. Verify specific firmware versions against Ubiquiti's official security advisory.

Exploitability

Exploitation requires two prerequisites: network access to an affected UniFi OS device and valid low-privilege user credentials. No special tools or advanced techniques are needed beyond crafting malicious SQL input through authenticated interfaces. The attack is deterministic (AC:L), requires no user interaction, and does not depend on specific configurations. Insider threats, compromised service accounts, and credential reuse across UniFi deployments significantly increase practical exploitability. The vulnerability has not been designated for inclusion in CISA's Known Exploited Vulnerabilities catalog as of the advisory date.

Remediation

Apply security patches released by Ubiquiti for UniFi OS. Verify the specific patched firmware versions from Ubiquiti's security advisory and plan a phased rollout across your device fleet. Additionally, restrict network access to UniFi OS management interfaces via firewall rules and network segmentation. Enforce strong password policies and disable unnecessary user accounts. Consider implementing additional authentication (such as network-level access controls or VPN gatekeeping) for administrative access to UniFi devices.

Patch guidance

Consult Ubiquiti's official security advisory for the specific patched firmware versions applicable to each device model and existing firmware revision. Schedule patching during a maintenance window to avoid service disruption, particularly for devices managing production network traffic or security camera feeds. Test patches in a lab environment first to ensure compatibility with your deployment. Prioritize devices that handle traffic for sensitive network segments or store critical logs. Some devices may require manual intervention to install firmware updates; plan accordingly for remote or geographically dispersed installations.

Detection guidance

Monitor UniFi OS audit logs and database activity for suspicious SQL-like patterns in authenticated API requests or query parameters, particularly involving administrative tables or user privilege records. Check for unexpected privilege escalations or new administrator accounts appearing without change management approval. Network-based detection should flag unusual query patterns to UniFi OS API endpoints coming from internal IPs with low-privilege credentials. Baseline normal administrative access patterns first to reduce false positives. If your SIEM integrates with UniFi logging, look for authentication anomalies or failed/successful privilege modifications.

Why prioritize this

This vulnerability merits immediate prioritization because it combines a high CVSS score (8.8), broad product scope across critical infrastructure roles, and a low barrier to exploitation for insiders or attackers with compromised credentials. Unlike remote unauthenticated flaws, privilege escalation vulnerabilities are often overlooked in patching schedules despite their ability to unlock full system compromise. The attack surface spans network gateways, video surveillance systems, and cloud management appliances—failure to patch could simultaneously expose multiple trust boundaries.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the combination of network-level accessibility (AV:N), low attack complexity (AC:L), high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), and no special privileges for post-exploitation (S:U). The requirement for low-privilege authentication (PR:L) prevents a maximum score but still indicates a severe vulnerability. The threat is materialized once an attacker gains initial low-level access—a realistic scenario in organizations with multiple UniFi users or where service accounts are reused. For organizations managing UniFi infrastructure as trust-critical, this should be treated as a 9+ equivalent in operational risk despite the numerical CVSS.

Frequently asked questions