CVE-2026-47370: Input Validation
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to execute a Command Injection within such UniFi OS devices or instances.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to UniFi OS devices and their management interfaces to trusted IPs and networks using firewalls, ACLs, or VLAN segmentation to prevent untrusted actors from reaching the devices.
- Compensating control
Place UniFi OS devices on a dedicated management network isolated from general user networks (network segmentation) and block access from less-trusted segments to reduce the attack surface available to low-privileged network users.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47370?
CVE-2026-47370 has a severity rating of critical at 9.9.
How do I fix CVE-2026-47370?
To mitigate CVE-2026-47370, it is recommended to update your Ubiquiti UniFi OS to the latest patched version.
What is the impact of CVE-2026-47370?
CVE-2026-47370 allows a low-privileged attacker with network access to perform command injection on vulnerable UniFi OS devices.
Who is affected by CVE-2026-47370?
CVE-2026-47370 affects devices running certain versions of Ubiquiti UniFi OS that have improper input validation.
What type of vulnerability is CVE-2026-47370?
CVE-2026-47370 is classified as an Improper Input Validation vulnerability leading to Command Injection.