A critical vulnerability, CVE-2026-22557, has been identified in the UniFi Network Application (UniFi Controller) affecting versions up to and including 10.1.85. This maximum-severity flaw enables unprivileged attackers to exploit a path traversal vulnerability to access sensitive files on targeted devices. By doing so, they can potentially hijack user accounts without requiring any interaction from users. Additionally, Ubiquiti has addressed another issue related to an authenticated NoSQL Injection that allows low-privilege actors to escalate their privileges within the application. These vulnerabilities pose significant risks as they could enable attackers to gain unauthorized access and control over network configurations, leading to potential disruption of services or data breaches.
- UniFi Network Application
- Upgrade UniFi Network Application to version 10.1.89 or later using the command: `sudo apt-get update && sudo apt-get install unifi`
- Review system logs for any signs of unauthorized access during the window of exposure.
- Change passwords for all user accounts as a precautionary measure.
This vulnerability has significant impact on common homelab stacks using Ubiquiti networking hardware. Specifically, versions of UniFi Network Application below 10.1.89 are at risk and should be upgraded immediately.