Cyber Resilience

CVE-2026-54409

Ui Unifi Protect ≤ 7.1.83

Published
02 July 2026
Modified
07 July 2026
Patch / advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0027 19th percentile
Risk Priority 54 floored blend · peak EPSS

Summary

CVE-2026-54409 is a high-severity Improper Initialization (CWE-665) vulnerability in Ui Unifi Protect. Its CVSS base score is 7.5 (High).

Operationally, ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UniFi Protect Application to bypass authentication in UniFi Protect Cameras.

CWE(s)

Related Threats

CVEs Like This One

CVE-2026-54407Same product: Ui Unifi Protect
CVE-2026-54408Same product: Ui Unifi Protect
CVE-2026-55115Same product: Ui Unifi Protect
CVE-2026-21633Same product: Ui Unifi Protect
CVE-2026-21634Same product: Ui Unifi Protect
CVE-2026-56841Same product: Ui Unifi Protect
CVE-2023-23119Same vendor: Ui
CVE-2026-33000Same vendor: Ui
CVE-2026-55117Same vendor: Ui
CVE-2023-32000Same vendor: Ui

Affected Assets

ui
unifi protect
≤ 7.1.83

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation directly exercises initialization paths and can reveal missing or incorrect resource setup.

Engineering principles applied during design and implementation can require explicit initialization to a known state.

Requiring the system to fail to a known state structurally reduces the chance that uninitialized resources remain reachable.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly enforce proper resource initialization during coding and testing.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect uninitialized variables but does not itself enforce initialization practices.

prevents

Configuration management can enforce secure defaults and initialization settings but is not the primary control for code-level initialization.

prevents

Secure development life cycle mandates initialization checks and secure defaults that directly prevent improper resource initialization.

prevents

Secure system architecture and engineering principles require explicit initialization of resources and secure state management.

prevents

Secure coding standards explicitly forbid uninitialized variables and mandate proper resource initialization before use.

References