Critical UniFi OS Flaw Enables Remote Code Execution

Security researchers have uncovered a severe unauthenticated Remote Code Execution vulnerability in Ubiquiti’s UniFi OS, tracked as CVE-2025-52665, which could let attackers gain complete control of UniFi devices without credentials. The flaw originated from a misconfigured backup API endpoint at /api/ucore/backup/export that was intended to operate only on the local loopback interface but was exposed via port 9780.

It stems from improper input validation on the dir parameter, with the backup orchestration system passing it directly to shell commands, enabling command injection through the inclusion of metacharacters. By sending a specially crafted JSON payload in a POST request, researchers demonstrated arbitrary code execution and even exfiltration of the /etc/passwd file, plus a reverse shell to prove full interactive access.

Additional unauthenticated endpoints were found beyond the primary RCE, including /api/v1/user_assets/nfc and /api/v1/user_assets/touch_pass/keys, which could allow provisioning credentials and accessing cryptographic material. The discovery reportedly earned a $25,000 bug bounty, and the vulnerabilities threaten UniFi Dream Machine routers and their access control systems, according to GBHackers on Security.