ZDI 2026-02-25

ZDI-26-126: (Pwn2Own) Ubiquiti Networks AI Pro Discovery Protocol Missing Encryption Protocol Downgrade Vulnerability

CVE-2026-21633 +1

Machine-generated analysis · WAYSCloud LLM

The advisory notes a protocol downgrade vulnerability in Ubiquiti Networks AI Pro's Discovery Protocol that can be exploited without authentication.

Context

The affected product is Ubiquiti Networks AI Pro, specifically its Discovery Protocol component. The vulnerability allows network-adjacent attackers to force a downgrade of the communication protocol. The advisory states that no authentication is required to exploit this issue. Worth noting is that the CVSS score is rated 5.4, indicating a medium severity impact.

Operator considerations

Check: Verify if Ubiquiti Networks AI Pro devices are present in the network environment.

From Zero Day Initiative ↗

This vulnerability allows network-adjacent attackers to downgrade the communication protocol on affected installations of Ubiquiti Networks AI Pro. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2026-21633.

Read the full advisory on ZDI →