Ubiquiti patches three maximum-severity UniFi flaws as 100,000 management interfaces remain exposed

Ubiquiti has fixed 22 critical UniFi vulnerabilities, including three rated CVSS 10.0, but internet scans found more than 100,000 exposed management interfaces worldwide.

Ubiquiti has issued a major security update for its UniFi range after disclosing 22 critical vulnerabilities in Security Advisory Bulletin 067, including three flaws rated at the maximum CVSS score of 10.0. According to the bulletin, the most severe issues affect UniFi Protect, UniFi OS Server and UniFi Talk, and can be exploited remotely without credentials or user interaction. That combination makes the advisory particularly significant for organisations that use UniFi consoles to manage both networking and physical security functions.

The company’s ecosystem has become increasingly central to small and medium-sized security deployments, bringing cameras, access control and voice services onto the same management plane as network switching and routing. That consolidation simplifies installation and administration, but it also increases the blast radius when a serious defect emerges. In this case, the headline flaws include a command injection issue in UniFi Protect, a CRLF injection vulnerability in UniFi OS Server that can lead to authentication bypass, and a separate weakness in UniFi Talk.

Ubiquiti has published fixed versions for the affected products: UniFi Protect 7.2.105 or later, UniFi OS Server 5.1.37 or later, UniFi Talk 5.3.2 or later, UniFi Access 4.3.5, Protect AI Key 2.2.6 and UniFi Network 10.5.67. UniFi Access is included in the bulletin as well, with four additional flaws addressed in version 4.3.5. For installers and administrators, the immediate priority is to confirm that every console under management is actually running the patched release, rather than assuming automatic updates have already done the job.

Exposure data from Censys suggests the scale of the problem is not limited to a single region. The internet measurement company said it found more than 100,000 UniFi OS management interfaces exposed worldwide on the day after disclosure, along with 828 UniFi Protect hosts. Around 3,200 of those UniFi OS systems were located in Australia, which Censys said amounted to about 3.1 per cent of the global total. That is a substantial footprint for a market of Australia’s size, particularly given how often one UniFi console now governs video, doors and networking together.

There was no confirmed in-the-wild exploitation at the time of disclosure, but recent history argues for speed. SEN noted that flaws in an earlier Ubiquiti bulletin were turned into botnet activity within roughly 33 days, while CISA ordered patching in June of three earlier UniFi OS vulnerabilities that attackers were using to distribute a Mirai loader. The practical lesson is straightforward: management interfaces should not be left on the open internet, and patching should be treated as part of ongoing maintenance rather than a one-off setup task. In addition to applying the updates, administrators should review exposed consoles for unexpected admin accounts, remove unnecessary port forwards and use Ubiquiti’s own remote access options or a VPN instead of direct internet exposure.