CVE-2026-55111: UniFi Protect Floodlight Path Traversal Vulnerability Analysis

Technical summary

CVE-2026-55111 is a CWE-22 path traversal vulnerability affecting UniFi Protect Floodlight devices and their firmware. The flaw permits an unauthenticated network-based attacker to traverse the device's file system and access sensitive files. The CVSS 3.1 score of 7.5 (HIGH) reflects high confidentiality impact with no integrity or availability risk. The attack vector is network-based, requires low complexity, and no privileges or user interaction. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog.

Business impact

Successful exploitation could expose sensitive data stored on Floodlight devices, potentially including configuration details, logs, or other operational information. Organizations relying on UniFi Protect Floodlight for security monitoring should prioritize understanding what data their devices store and assess whether unauthorized access constitutes a material compliance or privacy concern. The lack of integrity or availability impact means service continuity is unaffected, but data confidentiality is directly threatened.

Affected systems

UniFi Protect Floodlight devices and their firmware versions are affected. Organizations should verify which firmware versions running on their Floodlight devices are vulnerable. Check your deployment inventory and firmware revision against the vendor advisory to determine scope. Hardware platforms and specific firmware version ranges should be confirmed against Ubiquiti's official guidance.

Exploitability

The vulnerability is exploitable with low operational complexity from any network position without requiring authentication or user interaction. An attacker with network access—whether external or internal—can attempt exploitation immediately. The absence of exploitation barriers makes this a practical concern for any Floodlight device accessible on a network segment an attacker can reach. However, no public exploit code or KEV designation exists yet, indicating limited public weaponization at publication time.

Remediation

Verify affected firmware versions on your UniFi Protect Floodlight devices through Ubiquiti's official advisory. Apply the patched firmware version released by Ubiquiti. For devices unable to update immediately, restrict network access to Floodlight devices using firewall rules, VLANs, or access controls to limit exposure to trusted administrative segments only.

Patch guidance

Consult the Ubiquiti UniFi Protect advisory for the specific patched firmware version addressing CVE-2026-55111. Verify your current firmware version via the UniFi Protect management interface and apply the security update. Test the patch in a non-production environment first if possible. Monitor Ubiquiti's security announcements for any deployment notes or additional context regarding the update.

Detection guidance

Monitor for suspicious file access patterns or unusual HTTP/API requests to your Floodlight devices, particularly those attempting to traverse directories or access configuration or system files. Inspect device logs for authentication bypass attempts. Network segmentation monitoring can help identify devices attempting to reach Floodlight systems from unexpected locations. Consider enabling detailed logging on UniFi Protect devices if available.

Why prioritize this

This vulnerability merits HIGH priority due to its unauthenticated, network-based exploitability combined with direct confidentiality impact. While integrity and availability are unaffected, the ease of exploitation and lack of barriers mean any networked Floodlight device is immediately at risk. The absence of KEV designation should not reduce urgency—timely patching before exploitation becomes widespread is critical. Organizations with Floodlight devices in Internet-accessible or untrusted network segments should prioritize immediately.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: (1) Network attack vector requiring no special access; (2) Low attack complexity—no special conditions needed; (3) No authentication or user interaction required; (4) High confidentiality impact—sensitive files are readable; (5) No integrity or availability impact—files cannot be modified or the device disrupted. This scoring appropriately captures the practical risk of unauthenticated file access without overstating it, since data integrity and service availability remain protected.

Frequently asked questions