Summary
CVE-2026-77549 is a critical CRLF injection vulnerability (CWE-93) affecting UniFi OS Server and multiple other Ubiquiti UniFi OS-based devices and cloud instances. A network-accessible attacker who can inject unneutralized CRLF sequences into requests processed by UniFi OS may be able to bypass authentication mechanisms on the affected device or instance. The issue carries a CVSS v3.1 base score of 9.0 (Critical).
Technical details
- Root cause: UniFi OS fails to properly neutralize CRLF (carriage return / line feed) sequences in attacker-supplied input before it is processed by internal request-handling logic.
- Trigger conditions: An attacker crafts input containing CRLF sequences that are passed to a UniFi OS component responsible for enforcing authentication.
- Attack vector: Network — no local access or physical proximity is required; exploitation is remote.
- Privileges required: None (PR:N); attack complexity is rated High (AC:H), and no user interaction is required (UI:N).
- Impact: Successful exploitation allows authentication mechanisms to be circumvented, with confidentiality, integrity, and availability impacts all rated High under a Changed scope (S:C).
Affected software
- UniFi OS Server — versions prior to 5.1.37
- Cloud Keys — versions prior to 5.1.31
- Network Video Recorders — versions prior to 5.1.31
- Enterprise Network Video Recorders — versions prior to 5.1.31
- Enterprise Network Attached Storage — versions prior to 5.1.31
- Dream Machines — versions prior to 5.1.31
- Enterprise Firewall Core — versions prior to 5.1.31
- Dream Routers — versions prior to 5.1.31
- Enterprise Fortress Gateway — versions prior to 5.1.31
- Cloud Gateways — versions prior to 5.1.31
- Dream Wall — versions prior to 5.1.31
- Express 7 — versions prior to 5.1.31
- Network Attached Storage — versions prior to 5.1.32
- Express — versions prior to 4.0.17
Severity
CVSS v3.1 Base Score: 9.0 (Critical)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Update affected devices/instances to the fixed versions listed above (e.g., UniFi OS Server ≥ 5.1.37, most other affected products ≥ 5.1.31/5.1.32, Express ≥ 4.0.17). Apply updates via the UniFi OS update mechanism as soon as they are available for each device model.
- If immediate patching is not possible: Restrict network access to UniFi OS management interfaces to trusted networks only (e.g., VPN or firewall-restricted access), avoid exposing UniFi OS Server or console login interfaces directly to the internet, and monitor authentication logs for anomalous access patterns until the patch can be applied.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Page title:
UniFi OS