Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs

The US cybersecurity agency CISA is warning that attackers are actively exploiting three critical vulnerabilities in Ubiquiti UniFi OS devices, all rated with perfect 10 out of 10 severity scores. The flaws, which include an authentication bypass and command injection vulnerability, were reportedly exploited as zero-days before being patched last month, with users reporting automated attacks that created rogue administrator accounts. CISA has added these vulnerabilities to its Known Exploited Vulnerabilities catalog and is requiring federal agencies to patch them within three days, noting that compromised UniFi devices could allow attackers to move deeper into enterprise networks.