Ubiquiti UniFi OS Improper Input Validation Vulnerability (CVE-2026-34910)

let UniFiPorts = dynamic([443, 8443, 8080, 80]);
let SuspiciousPatterns = dynamic(["../", "..%2f", "..%2F", "%00", "<script", "';--", "union select", "exec(", "eval(", "cmd=", "command=", "ping -c", "wget ", "curl "]);
union DeviceNetworkEvents, CommonSecurityLog
| where TimeGenerated > ago(24h)
| where (DeviceName contains "unifi" or DeviceName contains "ubiquiti" or DeviceVendor contains "Ubiquiti" or DestinationPort in (UniFiPorts))
| where RequestURL has_any (SuspiciousPatterns) or RequestContext has_any (SuspiciousPatterns) or AdditionalExtensions has_any (SuspiciousPatterns)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL, RequestMethod, ResponseCode, DeviceName, DeviceVendor
| summarize AttemptCount=count(), DistinctURLs=dcount(RequestURL), SampleURLs=make_set(RequestURL, 5) by SourceIP, DestinationIP, bin(TimeGenerated, 5m)
| where AttemptCount > 3
| order by AttemptCount desc

index=* (sourcetype="cisco:asa" OR sourcetype="pan:traffic" OR sourcetype="stream:http" OR sourcetype="suricata" OR sourcetype="zeek_http")
| where (dest_port IN (443, 8443, 8080, 80) OR uri_path="*/api/*" OR uri_path="*/proxy/*")
| eval suspicious_input=if(match(uri_path, "(\.\./|\.\.%2[Ff]|%00|<script|union\s+select|exec\(|eval\(|cmd=|command=|ping\s+-c|wget\s|curl\s)"), 1, 0)
| where suspicious_input=1
| eval device_hint=if(match(host, "(?i)(unifi|ubnt|ubiquiti|udm|usg|dream)") OR match(dest, "(?i)(unifi|ubnt|ubiquiti)"), "UniFi-Device", "Unknown")
| stats count AS attempt_count, dc(uri_path) AS distinct_paths, values(uri_path) AS sample_paths, values(http_method) AS methods by src_ip, dest_ip, dest_port, device_hint
| where attempt_count > 3
| sort - attempt_count

sequence by source.ip with maxspan=5m
  [network where destination.port in (443, 8443, 8080, 80)
   and (
     url.path like~ "*../*" or
     url.path like~ "*..%2f*" or
     url.path like~ "*%00*" or
     url.query like~ "*union+select*" or
     url.query like~ "*exec(*" or
     url.query like~ "*cmd=*" or
     url.query like~ "*command=*" or
     url.query like~ "*wget+*" or
     url.query like~ "*curl+*"
   )
  ] with runs=3

SELECT sourceip, destinationip, destinationport, URL, "HTTP Method", "HTTP Response Code", LOGSOURCENAME(logsourceid) AS log_source, COUNT(*) AS attempt_count
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Palo Alto PA Series', 'Juniper SRX', 'Check Point FireWall-1', 'Snort', 'Suricata')
AND destinationport IN (443, 8443, 8080, 80)
AND (
  URL ILIKE '%../%'
  OR URL ILIKE '%..%2f%'
  OR URL ILIKE '%..%2F%'
  OR URL ILIKE '%cmd=%'
  OR URL ILIKE '%command=%'
  OR URL ILIKE '%union%select%'
  OR URL ILIKE '%exec(%'
  OR URL ILIKE '%eval(%'
  OR URL ILIKE '%wget %'
  OR URL ILIKE '%curl %'
  OR URL ILIKE '%%00%'
)
AND LOGSOURCENAME(logsourceid) ILIKE '%unifi%'
OR (
  destinationip IN (SELECT destinationip FROM events WHERE LOGSOURCENAME(logsourceid) ILIKE '%ubiquiti%' LAST 7 DAYS)
)
GROUP BY sourceip, destinationip, destinationport, URL, "HTTP Method", "HTTP Response Code", log_source
HAVING attempt_count > 3
ORDER BY attempt_count DESC
LAST 24 HOURS

_sourceCategory=network/firewall OR _sourceCategory=network/proxy OR _sourceCategory=ids/alerts
| where _raw matches /(?i)(unifi|ubnt|ubiquiti|udm|usg)/
| parse regex field=url "(?<suspicious_segment>(\.\./|\.\.%2[Ff]|%00|union.{0,5}select|exec\(|eval\(|cmd=|command=|wget\s|curl\s))" nodrop
| where !isNull(suspicious_segment) and suspicious_segment != ""
| fields src_ip, dest_ip, dest_port, url, method, status_code, suspicious_segment
| stats count AS attempt_count, dcount(url) AS unique_paths, values(suspicious_segment) AS observed_patterns by src_ip, dest_ip, dest_port
| where attempt_count > 3
| sort by attempt_count desc

rule cve_2026_34910_unifi_input_validation {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects exploitation attempts for CVE-2026-34910 - Ubiquiti UniFi OS Improper Input Validation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-34910"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.port in (443, 8443, 8080, 80)
    (
      re.regex($e.network.http.request_url, `(?i)(\.\./|\.\.)%2[Ff]|%00|union.{0,10}select|exec\(|eval\(|cmd=|command=|wget\s|curl\s`) or
      re.regex($e.network.http.request_body, `(?i)(cmd=|command=|exec\(|eval\(|union.{0,10}select|wget\s|curl\s)`)
    )
    (
      re.regex($e.target.hostname, `(?i)(unifi|ubnt|ubiquiti|udm|usg|dream-machine)`) or
      re.regex($e.target.asset.asset_id, `(?i)(ubiquiti|unifi)`)
    )
  condition:
    $e
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=HttpRequest
| TargetPort in [443, 8443, 8080, 80]
| HttpPath matches regex(?i) "(\.\./|\.\.%2[Ff]|%00|union.{0,10}select|exec\(|eval\(|cmd=|command=|wget\s|curl\s)"
| HostnameField matches regex(?i) "(unifi|ubnt|ubiquiti|udm|usg|dream.machine)"
| groupBy([RemoteAddressIP4, LocalAddressIP4, TargetPort, HttpPath], function=count(1, as=AttemptCount))
| AttemptCount > 3
| sort(AttemptCount, order=desc)