Requirements

• Python 3.10 or newer
• Network access to the target UniFi OS endpoint
• Authorization to perform testing

The script only uses the Python standard library, so there are no additional package installation steps.

Installation

Clone the repository or copy the script to the test machine, then enter the project directory:

No pip install is required. Ensure the interpreter you are using is suitable:

Usage

General format:

target must be a URL with an http:// or https:// scheme, for example https://192.0.2.10:11443.

Bypass probe

Runs the probe without sending any additional commands:

RCE testing

The second positional argument is treated as a command sent to the target. Use only approved, non-destructive commands:

The --proof option asks the target to create a proof file at /tmp/PWNED_34910:

Verify and remove the proof file through approved access procedures. Do not treat an HTTP 200 response as the sole evidence that the command succeeded.

File read testing

The script prints at most 800 characters from the file response.

Verbose mode

Add --verbose or -v to view request and response details:

Note that verbose output may contain sensitive URLs, parameters, or response data.

Command-Line Options

Use only one operation mode per execution. The program returns exit code 0 if the operation is considered successful, 1 if the target is not indicated as vulnerable or arguments are incomplete, and 2 if an unexpected error occurs. User interruption returns 130.

How It Works at a High Level

1. The script validates that the target has a scheme and hostname.
2. The script sends a request to the encoded auth traversal path.
3. The --check mode inspects the response for a marker indicating the handler was reached.
4. Command mode constructs the pkg_name value and sends it to the package update endpoint.
5. The --read mode constructs a path traversal to the app-assets alias and displays the response in a limited manner.

The implementation is entirely in CVE-2026-34910.py.

Limitations and Interpreting Results

• Marker-based probes are not a comprehensive verification and can produce false positives or false negatives.
• HTTP responses are influenced by firmware, reverse proxies, network configuration, and endpoint implementation.
• HTTP status 200 in RCE mode indicates the request was accepted by the handler, not a guarantee that the command completed as expected.
• The script disables TLS certificate verification. Run it only on test networks and do not consider the connection to provide server authentication.
• The HTTP timeout is fixed at 15 seconds and cannot be changed via the CLI.
• The script does not provide automated remediation.

Remediation

For devices within the testing scope:

1. Identify the UniFi OS version and device model.
2. Check official Ubiquiti security advisories for remediation status and recommended firmware versions.
3. Update the device through approved change management procedures.
4. Restrict network access to the administrative interface and monitor logs for suspicious requests.
5. Repeat validation only after obtaining authorization and a post-remediation testing plan.

Reporting

Test reports should record:

• Device model, UniFi OS version, and testing time.
• Target address masked if the report is shared outside the team.
• Modes and arguments used.
• Response codes and a summary of results without exposing sensitive data.
• Minimum evidence required for reproduction.
• Impact, confidence level, and remediation recommendations.

For responsible vulnerability reporting, use the vendor's official security channels and coordinate disclosure according to applicable policies.

License

No license has been specified for this project. Add a license file before distributing or using this code in other projects.

Authors

Gagaltotal666 - GhostGTR666

Related repository: github.com/gagaltotal