What’s Vulnerable › Vulnerabilities

CVE-2024-27981

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-04 · updated 2026-06-17
• Weakness: CWE-77

Description

A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.0.28 and earlier) allows a malicious actor with UniFi Network Application Administrator credentials to escalate privileges to root on the host device. Affected Products: UniFi Network Application (Version 8.0.28 and earlier) . Mitigation: Update UniFi Network Application to Version 8.1.113 or later.

Affected products

• Ubiquiti Unifi Network Application: before 8.1.113 — fixed in 8.1.113

How to fix

Upgrade to a fixed version: Ubiquiti Unifi Network Application 8.1.113. Check the vendor advisory for mitigations.

References

• https://community.ui.com/releases/Security-Advisory-Bulletin-038-038/9d13fead-47de-4372-b2c1-745b8d6b0399
• https://community.ui.com/releases/Security-Advisory-Bulletin-038-038/9d13fead-47de-4372-b2c1-745b8d6b0399

Get alerted when CVE-2024-27981 or the next vulnerability affects your stack