Skip to content
Connect AISign inSign up free

Bug bounty program

UI

Ubiquiti Inc.

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
53
Disclosed reports
98
Subdomains
65,627
Vendor on CyberSIXT
Ubiquiti Inc (145 CVEs, 4 exploited), Ui (54 CVEs, 0 exploited)

Most upvoted reports98

All reports
Most upvoted reports of Ubiquiti Inc.
ReportWeaknessDisclosedBountyVotes
Privilege Escalation From user to SYSTEM via unauthenticated command executionAnalysed#544928Command and Code Injection2019-11-08–553
Privilege-0 to Root Privilege Escalation on EdgeSwitchAnalysed#511025Access Control2019-03-31–82
Public Jenkins instance with /script enabledAnalysed#403402Command and Code Injection2018-09-10–74
Remote Code Execution at http://tw.corp.ubnt.comAnalysed#269066Command and Code Injection2017-11-29–61
Subdomain takeover on partners.ubnt.com due to non-used CloudFront DNS entryAnalysed#145224Access Control2016-11-27–57
CORS Misconfiguration leading to Private Information DisclosureAnalysed#430249Access Control2019-06-07–57
Login as root without password on EdgeSwitchXAnalysed#512958Authentication2019-03-31–56
Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.com#172137Cross-Site Request Forgery2016-11-29–55
Ability to log in as any user without authentication if █████████ is emptyAnalysed#215053Authentication2017-08-08–54
Unrestricted File System Access via Twig Template Injection on dev-ucrm-billing-demo.ubnt.comAnalysed#301406No weakness recorded2018-03-07–47

Subdomains65,627

Root:ubnt.com
Scope
Name suggests:Internal
First seen
Text fileClear filters25 names
Subdomains of Ubiquiti Inc.
NameScopeFirst seen
corp.ubnt.cominternalIn scope2026-11-14
fs.corp.ubnt.cominternalIn scope2026-11-14
lt.corp.ubnt.cominternalIn scope2026-11-14
sj.corp.ubnt.cominternalIn scope2026-11-14
tw.corp.ubnt.cominternalIn scope2026-11-14
us.corp.ubnt.cominternalIn scope2026-11-14
atl.corp.ubnt.cominternalIn scope2026-11-14
irc.corp.ubnt.cominternalIn scope2026-11-14
mfi.corp.ubnt.cominternalIn scope2026-11-14
vpn.corp.ubnt.cominternal, vpnIn scope2026-11-14
ldap.corp.ubnt.cominternalIn scope2026-11-14
leaf.corp.ubnt.cominternalIn scope2026-11-14
riga.corp.ubnt.cominternalIn scope2026-11-14
marvin.corp.ubnt.cominternalIn scope2026-11-14
portal.corp.ubnt.cominternalIn scope2026-11-14
www.lt.corp.ubnt.cominternalIn scope2026-11-14
jenkins.corp.ubnt.comci, internalIn scope2026-11-14
autotest.corp.ubnt.cominternalIn scope2026-11-14
registry.corp.ubnt.cominternal, toolsIn scope2026-11-14
rix-hive.corp.ubnt.cominternalIn scope2026-11-14
rix-nest.corp.ubnt.cominternalIn scope2026-11-14
directory.corp.ubnt.cominternalIn scope2026-11-14
talkbuilder.corp.ubnt.cominternalIn scope2026-11-14
www.rix-hive.corp.ubnt.cominternalIn scope2026-11-14
tpe-cloud-service-ci.corp.ubnt.comci, internalIn scope2026-11-14

65,568 names are covered by the program's own scope; 140 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated