Description
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Denial of Service (DoS) attack on the application.
Published: 2026-07-02
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an Improper Input Validation flaw that lets an attacker with network-level access send malformed data to the UniFi Network Application, causing the controller to crash or become unresponsive. The resulting denial of service affects only the availability of the network management interface, with no indication of confidentiality or integrity compromise.

Affected Systems

The flaw affects the UniFi Network Application from Ubiquiti Inc. No specific version information is provided, so the issue is presumed to apply to all current releases until a vendor patch is available.

Risk and Exploitability

The CVSS score of 7.5 classifies the vulnerability as high severity, while an EPSS score of <1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers need network-level access to reach the controller, from which they could repeatedly send crafted requests to trigger the DoS.

Generated by OpenCVE AI on July 17, 2026 at 10:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official patch or upgrade to a version that includes the input validation fix as released by Ubiquiti.
  • Restrict inbound traffic to the UniFi controller by limiting access to trusted IP addresses or applying firewall rules, ensuring only authorized management traffic can reach the controller.
  • Monitor controller logs and network traffic for abnormal or repeated malformed requests that may indicate a DoS attempt, and implement rate‑limiting or alerting as appropriate.

Generated by OpenCVE AI on July 17, 2026 at 10:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
Title Improper Input Validation in Ubiquiti UniFi Network Application Enables Network‑Level Denial of Service

Wed, 15 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Title Improper Input Validation Enables Network-Level Denial of Service on UniFi Network Application

Mon, 13 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Title Improper Input Validation Enables Network-Level Denial of Service on UniFi Network Application

Sun, 12 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
Title Improper Input Validation in UniFi Network Application Allows Denial of Service

Sat, 11 Jul 2026 06:30:00 +0000

Type Values Removed Values Added
Title Improper Input Validation in UniFi Network Application Allows Denial of Service

Fri, 10 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Title Denial of Service via Improper Input Validation in Ubiquiti UniFi Network Application

Thu, 09 Jul 2026 05:45:00 +0000

Type Values Removed Values Added
Title Denial of Service via Improper Input Validation in Ubiquiti UniFi Network Application

Wed, 08 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title Improper Input Validation in UniFi Network Application Enables Denial of Service

Wed, 08 Jul 2026 00:45:00 +0000

Type Values Removed Values Added
Title Improper Input Validation in UniFi Network Application Enables Denial of Service

Tue, 07 Jul 2026 08:45:00 +0000

Type Values Removed Values Added
Title Improper Input Validation in UniFi Network Application Enables Denial of Service

Mon, 06 Jul 2026 11:15:00 +0000

Type Values Removed Values Added
Title Improper Input Validation in UniFi Network Application Enables Denial of Service

Sun, 05 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Title Denial of Service via Improper Input Validation in Ubiquiti UniFi Network Application

Sun, 05 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Title Denial of Service via Improper Input Validation in Ubiquiti UniFi Network Application

Sat, 04 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Title Denial of Service via Improper Input Validation in UniFi Network Application

Sat, 04 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Denial of Service via Improper Input Validation in UniFi Network Application

Sat, 04 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Title Denial of Service via Improper Input Validation in UniFi Network Application

Fri, 03 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Title Denial of Service via Improper Input Validation in UniFi Network Application

Fri, 03 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Title Improper Input Validation in UniFi Network Application Enables DoS

Thu, 02 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Title Improper Input Validation in UniFi Network Application Enables DoS

Thu, 02 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Ubiquiti
Ubiquiti unifi Network Application
Vendors & Products Ubiquiti
Ubiquiti unifi Network Application

Thu, 02 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
Description A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Denial of Service (DoS) attack on the application.
Weaknesses CWE-20
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Ubiquiti Unifi Network Application
cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published:

Updated: 2026-07-02T16:09:09.474Z

Reserved: 2026-06-13T15:00:00.605Z

Link: CVE-2026-54405

cve-icon Vulnrichment

Updated: 2026-07-02T16:09:06.561Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-17T10:45:05Z

Weaknesses
  • CWE-20

    Improper Input Validation