Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Authenticated RCE in ToughSwitch#273449 | Valid | Command and Code Injection | High | 2018-06-19 | – | 6 |
| Local File Disclosure (+XSS+CSRF) in AirOS 6.2.0 devices#661647 | Valid | Command and Code Injection | Medium | 2020-06-30 | – | 6 |
| Command injection in the process of downloading the latest version of the cloud key firmware through the unifi management software.#183458 | Valid | Command and Code Injection | High | 2017-12-11 | – | 7 |
| Code Execution in restricted CLI of EdgeSwitch#313245 | Valid | Command and Code Injection | High | 2018-06-19 | – | 8 |
| HTML Injection on airlink.ubnt.com#226783 | Valid | Command and Code Injection | Low | 2017-06-22 | – | 9 |
| Triggering RCE using XSS to bypass CSRF in PowerBeam M5 300#289264 | Valid | Command and Code Injection | High | 2018-06-19 | – | 12 |
| RCE in AirOS 6.2.0 Devices with CSRF bypass#703659 | Valid | Command and Code Injection | High | 2020-06-30 | – | 12 |
| EdgeSwitch Command InjectionAnalysed#508256 | Valid | Command and Code Injection | Medium | 2019-03-31 | – | 15 |
| Read-Only user can execute arbitraty shell commands on AirOSAnalysed#119317 | Valid | Command and Code Injection | – | 2016-08-05 | – | 18 |
| Shell Injection via Web Management Console (dl-fw.cgi)Analysed#121940 | Valid | Command and Code Injection | – | 2016-10-15 | – | 20 |
| Subdomain Takeover in http://assets.goubiquiti.com/Analysed#109699 | Valid | Command and Code Injection | – | 2016-02-14 | – | 22 |
| Read-Only user can execute arbitraty shell commands on AirOSAnalysed#128750 | Valid | Command and Code Injection | – | 2016-08-05 | – | 22 |
| [EdgeSwitch] Web GUI command injection as root with Privilege-1 and Privilege-15 usersAnalysed#197958 | Valid | Command and Code Injection | Medium | 2017-07-21 | – | 27 |
| Readonly to Root Privilege Escalation on EdgeSwitchAnalysed#796414 | Valid | Command and Code Injection | High | 2021-05-23 | – | 27 |
| View Only to Root Privilege Escalation on UniFi ProtectAnalysed#825764 | Valid | Command and Code Injection | High | 2021-05-23 | – | 42 |
| Read-Only user can execute arbitraty shell commands on AirOSAnalysed#139398 | Valid | Command and Code Injection | – | 2016-08-05 | – | 44 |
| Remote Code Execution at http://tw.corp.ubnt.comAnalysed#269066 | Valid | Command and Code Injection | Critical | 2017-11-29 | – | 61 |
| Public Jenkins instance with /script enabledAnalysed#403402 | Valid | Command and Code Injection | Critical | 2018-09-10 | – | 74 |
| Privilege Escalation From user to SYSTEM via unauthenticated command executionAnalysed#544928 | Valid | Command and Code Injection | Critical | 2019-11-08 | – | 553 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.