This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Ubiquiti fixes 3 vulnerabilities
Ubiquiti versions 6.2.72 and 1.6.1 fix 3 vulnerabilities in the UniFi Protect Application and UniFi Connect EV Station Lite products [1][2].
An unauthenticated attacker on the local network can gain unauthorized access to a UniFi Protect Camera device by exploiting a vulnerability in the discovery protocol of UniFi Protect Application [1].
The vulnerability is present in product:
- UniFi Protect Application; >=6.1.79, <6.2.72
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-21633 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 5. 1. 2026.
An unauthenticated attacker on the local network can trigger an overflow in the discovery protocol of UniFi Protect Application, causing it to restart [1].
The vulnerability is present in product:
- UniFi Protect Application; >=6.1.79, <6.2.72
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-21634 at cve.org, NVD
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org
The vulnerability was publicly disclosed 5. 1. 2026.
An unauthenticated attacker within Wi-Fi range of the EV Station Lite device can abuse the WiFi AutoLink feature even against a device that was added to the system only via Ethernet [2].
The vulnerability is present in product:
- UniFi Connect EV Station Lite; <1.6.1
CVSS: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2026-21635 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 5. 1. 2026.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 6. 1. 2026.