Ubiquiti Inc. · disclosed reports
Command and Code Injection
19 disclosed reports · $0 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Ubiquiti Inc. on HackerOne- reports
- 19
- paid a bounty
- 0
Every one of the 19 is a mark on the map. Named now: 1 to 19, most upvoted first.
- Privilege Escalation From user to SYSTEM via unauthenticated command execution
- Public Jenkins instance with /script enabled
- Remote Code Execution at http://tw.corp.ubnt.com
- Read-Only user can execute arbitraty shell commands on AirOS
- View Only to Root Privilege Escalation on UniFi Protect
- Readonly to Root Privilege Escalation on EdgeSwitch
- [EdgeSwitch] Web GUI command injection as root with Privilege-1 and Privilege-15 users
- Read-Only user can execute arbitraty shell commands on AirOS
- Subdomain Takeover in http://assets.goubiquiti.com/
- Shell Injection via Web Management Console (dl-fw.cgi)
- Read-Only user can execute arbitraty shell commands on AirOS
- EdgeSwitch Command Injection
- RCE in AirOS 6.2.0 Devices with CSRF bypass
- Triggering RCE using XSS to bypass CSRF in PowerBeam M5 300
- HTML Injection on airlink.ubnt.com
- Code Execution in restricted CLI of EdgeSwitch
- Command injection in the process of downloading the latest version of the cloud key firmware through the unifi management software.
- Local File Disclosure (+XSS+CSRF) in AirOS 6.2.0 devices
- Authenticated RCE in ToughSwitch
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.