High severity7.8NVD Advisory· Published Sep 13, 2024· Updated Jun 17, 2026

CVE-2024-42025

Description

A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and earlier) allows a malicious actor with unifi user shell access to escalate privileges to root on the host device.

Affected products

Ubiquiti Inc/Unifi Network Applicationllm-fuzzy2 versions
<=8.3.32+ 1 more
- (no CPE)range: <=8.3.32
- (no CPE)range: 8.4.59

Patches

Vulnerability mechanics

References

community.ui.com/releases/Security-Advisory-Bulletin-042-042/c4f68b56-cdc4-4128-b2cb-5870209d1704nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000