ثلاثة سلسلة Ubiquiti CVE توفر RCE الكامل، طلبات CISA 3 أيام

Three Ubiquiti UniFi OS vulnerabilities chain into full remote code execution, and attackers are already exploiting them. CISA added all three to its Known Exploited Vulnerabilities catalog on June 24, giving federal agencies three days under BOD 26-04 to apply patches.

The Chain: Access Bypass, Path Traversal, Command Injection

Bishop Fox researchers publicly demonstrated the chain earlier this month. Start with CVE-2026-34908, an access control bypass allowing an unauthenticated attacker to make unauthorized changes to the system. Follow it with CVE-2026-34909, a directory traversal that leaks configuration files and credentials. Finish with CVE-2026-34910, an input validation flaw that injects arbitrary OS commands. The result: complete system takeover with elevated privileges.

Ubiquiti shipped fixes in May. Bishop Fox also published a free detection script on GitHub to help defenders find vulnerable instances.

Lantronix Joins the Exploitation Party

CISA also added a critical command injection in Lantronix EDS5000 serial-to-ethernet servers (CVE-2025-67038, CVSS 9.8). The HTTP RPC module concatenates the username directly into a shell command without sanitization. An attacker injects OS commands at root level. Lantronix patched it in firmware version 2.2.0.0R1.

CISA has not disclosed who is exploiting these flaws or whether ransomware groups are involved (the flag is set to "Unknown" for all four). That absence of data makes the three-day federal deadline even more urgent for anyone running these devices.

What to Do Now

Patch Ubiquiti UniFi OS devices to the latest firmware immediately. Apply the Lantronix EDS5000 upgrade to 2.2.0.0R1. If you can't patch within three days, implement vendor-recommended mitigations or isolate the devices from untrusted networks.

The combination of pre-authentication exploitation, publicly available chains, and confirmed active attacks means defenders have no room for delay. Test every layer before attackers do.

Source: CISA warns of max severity Ubiquiti flaws exploited in attacks
Domain: bleepingcomputer.com