Ubiquiti UniFi OS Server < 5.1.37 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(344795);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/11");

  script_cve_id("CVE-2026-77549", "CVE-2026-77550");
  script_xref(name:"IAVA", value:"2026-A-0978");

  script_name(english:"Ubiquiti UniFi OS Server < 5.1.37 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote host is affected by multiple
vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Ubiquiti UniFi OS Server installed on the remote host is prior
to 5.1.37. It is, therefore, affected by multiple vulnerabilities:

  - A malicious actor with access to the network and under certain
    conditions could exploit an Improper Neutralization of CRLF
    Sequences vulnerability found in certain devices running UniFi OS
    to bypass authentication to such UniFi OS devices or instances.
    (CVE-2026-77549)

  - A malicious actor with access to the network could exploit an
    Improper Neutralization of CRLF Sequences vulnerability found in
    certain devices running UniFi OS to bypass authentication to such
    UniFi OS devices or instances. (CVE-2026-77550)

Note that Nessus has not tested for these issues but has instead relied only on
the application's self-reported version number.");
  # https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ec94ad23");
  script_set_attribute(attribute:"solution", value:
"Upgrade Ubiquiti UniFi OS Server to version 5.1.37 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-77550");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/a:ui:unifi_os_server");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ubnt_unifi_os_server_installed.nbin");
  script_require_keys("installed_sw/Ubiquiti UniFi OS Server");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::get_app_info(app:'Ubiquiti UniFi OS Server');
vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  {'fixed_version' : '5.1.37'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);