ZDI 2026-02-25

ZDI-26-127: (Pwn2Own) Ubiquiti Networks AI Pro Cleartext Transmission Information Disclosure Vulnerability

CVE-2026-21633 +1

Machine-generated analysis · WAYSCloud LLM

Ubiquiti AI Pro transmits sensitive information in cleartext without requiring authentication. Network-adjacent attackers can exploit this to disclose data.

Context

The vulnerability affects Ubiquiti Networks AI Pro. The source describes an information disclosure vulnerability involving cleartext transmission. The advisory notes that authentication is not required for exploitation and assigns a CVSS rating of 5.3.

Operator considerations

Check: Inventory Ubiquiti Networks AI Pro installations.
Isolate: Restrict network access to Ubiquiti AI Pro devices to trusted segments.

From Zero Day Initiative ↗

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Ubiquiti Networks AI Pro. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.3. The following CVEs are assigned: CVE-2026-21633.

Read the full advisory on ZDI →