CVE-2026-77549: CRLF Injection
A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Certain devices running UniFi OS are affected. Exploitation requires network access to the affected UniFi OS device or instance.
Does exploiting this vulnerability require credentials or user interaction?
No credentials or user interaction are required according to the provided vector. However, exploitation has high attack complexity and is only possible under certain conditions.
What could an attacker achieve if exploitation succeeds?
An attacker could bypass authentication to the affected UniFi OS device or instance. The vulnerability is rated as having high confidentiality, integrity, and availability impact, with scope changed.