A critical unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2025-52665, CVSS 9.8) was discovered in Ubiquiti’s UniFi OS, exposing the backup API infrastructure across UniFi devices (Network, Protect, Access). The flaw stemmed from improper input validation in the `/api/ucore/backup/export` endpoint, allowing attackers to inject shell metacharacters via the `dir` parameter and execute arbitrary system commands with elevated privileges. Exploitation involved chaining unsanitized inputs in commands like `mktemp`, `tar`, and `du`, leading to full system compromise, including reverse shell access and sensitive data exfiltration.The vulnerability was exacerbated by misconfigured network exposure—the endpoint, intended for local access (`127.0.0.1`), was inadvertently exposed on port 9780 via an external proxy. Researchers also uncovered additional unauthenticated API endpoints enabling unauthorized access to NFC credentials, cryptographic keys, and door control systems. While no confirmed breaches were reported, the flaw posed a severe risk of large-scale device takeover, lateral movement within networks, and potential disruption of physical security systems (e.g., access controls). Ubiquiti issued patches, but unpatched systems remain at risk of complete operational sabotage or data theft by remote attackers.

Networking device maker Ubiquiti suffered from a data breach security incident that exposed its customers' data. An unauthorized party gained access to certain of Networking device maker Ubiquiti information technology systems hosted by a third party cloud provider. The compromised information included name, email address, the one-way encrypted password, account address and phone number. Ubiquiti investigated the incident and started emailing customers to change their passwords and enable 2FA.