Popping Root on Unifi OS: Unauthenticated RCE Chain Detection and Analysis
Bishop Fox researchers discovered an unauthenticated remote code execution chain in UniFi OS that allows attackers to gain root access on Ubiquiti Cloud Gateways and Dream Machines. The exploit leverages multiple vulnerabilities including insecure firmware encryption, a hidden API on a secondary port, and improper input validation. Ubiquiti has released patches following responsible disclosure.
Background
- UniFi is Ubiquiti's line of Wi-Fi access points, switches, and security cameras, managed by a controller (UniFi Network Application) running on UniFi OS.
- UniFi OS powers Ubiquiti's Dream Machine, Cloud Key, and Cloud Gateway devices — all-in-one network appliances combining routing, switching, and management.
- "Popping root" means getting full system-level (root) control of a device, letting an attacker read all traffic, install malware, or pivot deeper into a network.
- RCE (Remote Code Execution) lets attackers run arbitrary commands on a target system over the network.
- An "unauthenticated RCE chain" links multiple bugs together so code execution is possible without any login credentials.
- Bishop Fox is an offensive security firm that found and responsibly disclosed these flaws to Ubiquiti before publishing their research.