CRLF Injection Enables Authentication Bypass in Ubiquiti UniFi OS Devices

A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

The vendor advisory identifies the affected and fixed branches as follows:

• UniFi OS Server: affected through version 5.1.21; fixed in 5.1.37.
• Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall, and Express 7: affected through version 5.1.26; fixed in 5.1.31.
• Network Attached Storage: the vendor advisory specifies 5.1.32 as the fixed release, although the product is also listed in the group affected through version 5.1.26. Verify this branch against the product-specific release.
• Express: affected through version 4.0.16; fixed in 4.0.17.

The supplied normalized record expresses broader affected ranges, namely <5.1.37 for UniFi OS Server, <5.1.31 for most products, <5.1.32 for Network Attached Storage, and <4.0.17 for Express. Because the structured ranges conflict with the vendor advisory's explicit affected-version wording, use the vendor's stated affected boundaries for initial triage and verify versions between those boundaries and the corresponding fixed release directly.

The flaw is classified as CWE-93 and results from improper neutralization of CRLF sequences in UniFi OS processing. A network attacker can provide input that affects authentication handling and bypasses the authentication check. The record confirms that exploitation requires no prior privileges or user interaction and has low complexity. The affected endpoint, input field, parser, and exact processing path are not disclosed, so a particular HTTP header, route, or payload should not be assumed. The assessed scope crosses the security boundary of the affected UniFi OS device or instance.

The vulnerability is remotely reachable over the network on affected UniFi OS devices or instances. The record characterizes exploitation as requiring no prior authentication, no user interaction, and low complexity; the vendor advisory also states that exploitation depends on certain conditions on the device. The supplied public-exploit field is false, and associated enrichment records exploitation as none at the time of assessment. This does not establish that exploitation has not occurred in every environment or that future exploitation will not occur.

The flaw can result in authentication bypass on an affected UniFi OS device or instance, allowing access without valid credentials. Because the attack is network reachable and requires no user interaction, exposure is greater for devices reachable from untrusted or insufficiently segmented network locations. The technical outcome could affect the confidentiality, integrity, and availability of resources protected by the authentication boundary, but the record does not identify the exact functions available after bypass. The assessed scope is changed, while the precise service boundary crossed and the post-bypass privilege level remain undisclosed. The record provides no evidence of a specific breach or actual service disruption.

• An attacker on the network may gain unauthorized access to affected UniFi OS devices or instances by bypassing authentication.
• Unauthorized access could expose configuration or managed data, permit configuration changes, or disrupt device operation. These are possible consequences, not evidence that a particular organization was breached.
• The affected scope covers multiple product families, so centralized management environments or deployments with many UniFi OS devices may require a product-by-product inventory and update review.
• The record does not confirm data loss, persistence, an actual outage, or a specific breach.

1. Update UniFi OS Server to 5.1.37 or later as directed by the vendor.
2. Update Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall, and Express 7 to 5.1.31 or later.
3. Update Network Attached Storage to 5.1.32 or later.
4. Update Express to 4.0.17 or later.
5. Check each product family separately and confirm the installed version after updating. Do not place Network Attached Storage in the 5.1.31 fixed branch because the vendor advisory specifies a separate milestone for that product.
6. The available evidence does not describe a separate workaround beyond updating. Until remediation is verified, treat devices within the vendor-defined affected boundaries as exposed.

• Inventory devices running UniFi OS, including UniFi OS Server, Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall, Express 7, and Express.
• Compare installed UniFi OS versions with the affected and fixed boundaries listed in affected_summary; do not treat a product's default unaffected status as proof that an installed version is safe.
• Review update history and deployment status in the device management system, and verify each product branch separately.
• Review authentication and access logs for unexpected successful access from untrusted or unplanned network sources while devices were exposed. This is precautionary monitoring only because the record provides no specific log event or IOC.
• Do not treat the absence of matching log evidence as proof that a device was not exploited.