CVE-2018-5264: UI UniFi Firmware

Medium severity, CVSS 5.9. EPSS: 1.5% chance of exploitation in the next 30 days.

Ubiquiti UniFi 52 devices, when Hotspot mode is used, allow remote attackers to bypass intended restrictions on "free time" Wi-Fi usage by sending a /guest/s/default/ request to obtain a cookie, and then using this cookie in a /guest/s/default/login request with the byfree parameter.

Affected products

• UI UniFi Firmware: affected versions not specified

Published 2019-06-07. Last modified 2026-06-17.