Ubiquiti Inc UniFi gateways exposed to denial of service through uncontrolled recursion

A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.

• Dream Machines: semver versions 0 < 5.1.31 are marked affected; the default status is unaffected outside the stated range.
• Enterprise Firewalls: semver versions 0 < 5.1.31 are marked affected; the default status is unaffected outside the stated range.
• Dream Routers: semver versions 0 < 5.1.31 are marked affected; the default status is unaffected outside the stated range.
• Cloud Gateways: semver versions 0 < 5.1.31 are marked affected; the default status is unaffected outside the stated range.
• Dream Wall: semver versions 0 < 5.1.31 are marked affected; the default status is unaffected outside the stated range.
• Express: semver versions 0 < 4.0.21 are marked affected; the default status is unaffected outside the stated range.
• Express 7: semver versions 0 < 5.1.31 are marked affected; the default status is unaffected outside the stated range.
• UniFi Gateways: semver versions 0 < 5.1.26 are marked affected; the default status is unaffected outside the stated range.

The weakness is classified as CWE-674, Uncontrolled Recursion. The supplied record describes a malicious actor with network access reaching a vulnerable UniFi gateway; the attack is assessed as requiring no privileges or user interaction and low complexity. If the attacker supplies input that drives uncontrolled recursion, the device can enter a denial-of-service condition. The record does not identify the exposed protocol, endpoint, message format, recursion path, stack behavior, or whether recovery requires a reboot, so those implementation details must not be assumed. The affected scope is device availability; no confidentiality or integrity impact is identified.

Reachability is network based. The supplied assessment describes no required privileges, no user interaction, and low attack complexity. The record marks public exploit as false, while the known-exploited field is not populated; CISA enrichment records exploitation as none in its assessment. No exploit payload, affected protocol, or attack sequence is disclosed, so exploitation should not be inferred beyond the documented DoS outcome.

The confirmed technical impact is loss of availability of the targeted gateway, without a stated confidentiality or integrity effect. Because the scope is assessed as unchanged, the established result is limited to the vulnerable device and does not demonstrate compromise of other security authorities. In an enterprise or branch deployment, loss of that gateway could plausibly interrupt connectivity, routing, or policy enforcement for dependent systems, depending on topology and redundancy. The record does not establish code execution, privilege escalation, data access, persistence, or cross-device compromise.

Successful exploitation could make the targeted gateway unavailable and interrupt services that depend on it for network connectivity or traffic control. This may affect users and downstream systems behind the device, but the record does not establish compromise of confidentiality or integrity. The broader operational effect depends on the gateway's role, network topology, and available redundancy. No breach, data disclosure, privilege takeover, or organizational compromise is established.

1. Inventory the exact model, product branch, and installed version of every Ubiquiti gateway in operation.
2. For Dream Machines, Enterprise Firewalls, Dream Routers, Cloud Gateways, and Dream Wall, update using the Ubiquiti release corresponding to the recorded 5.1.31 branch boundary, then verify that the deployed version is outside the affected range.
3. For Express, use the 4.0.21 branch boundary; for Express 7, use the 5.1.31 branch boundary; for UniFi Gateways, use the 5.1.26 branch boundary. Confirm that the selected release supports the exact hardware model before deployment.
4. Do not apply one product group's boundary to another group, because the record provides separate ranges for each branch.
5. The record provides no specific vendor interim mitigation. Because exploitation requires network access, reducing untrusted network paths to the gateway may reduce risk temporarily, but it is not a substitute for the vendor update.
6. After updating, recheck inventory, service availability, and network reachability for each device.

1. Inventory Ubiquiti devices in the Dream Machines, Enterprise Firewalls, Dream Routers, Cloud Gateways, Dream Wall, Express, Express 7, and UniFi Gateways product groups, including the software branch in use.
2. Compare deployed versions with the affected ranges in the record, keeping each product branch separate rather than applying one threshold to every device.
3. Map network paths through which untrusted or less-trusted sources can reach the gateways, because exploitation requires network access.
4. As a precautionary monitoring measure, review unexpected gateway service interruptions, loss of traffic forwarding, or loss of management access. These are general operational symptoms, not confirmed indicators for this vulnerability.
5. The record provides no specific log event, IOC, endpoint, or traffic pattern; absence of those signals does not prove that a device is safe.