Critical UniFi OS RCE Chain Grants Root Access Without Credentials

Security Advisory Bulletin 064 describes a critical chained vulnerability in UniFi OS Server (several CVEs) that allows an unauthenticated attacker to craft a single HTTP request to bypass the authentication gateway, exploit a command-injection sink in the package-update backend, and escalate to root (e.g., via sudo dpkg) to obtain persistent full control of the management plane; Bishop Fox reproduced the chain on 5.0.6 and fixes are provided in 5.0.8. Immediate mitigations include patching, blocking external admin access, and rotating all exposed secrets and keys.