CVE-2016-7792 in UniFi AP AC Lite
Summary
by MITRE
Ubiquiti Networks UniFi 5.2.7 does not restrict access to the database, which allows remote attackers to modify the database by directly connecting to it.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/14/2026
The vulnerability identified as CVE-2016-7792 affects Ubiquiti Networks UniFi version 5.2.7 and represents a critical access control flaw that undermines the security posture of network infrastructure devices. This issue stems from insufficient database access restrictions within the UniFi controller software, creating a pathway for remote attackers to directly interact with the underlying database system without proper authentication or authorization mechanisms. The vulnerability specifically targets the database layer of the UniFi management platform, which serves as the central repository for all network configuration data, user accounts, and operational settings. Attackers exploiting this weakness can establish direct database connections and manipulate stored information, potentially compromising the entire network infrastructure managed by the UniFi controller.
The technical nature of this vulnerability aligns with CWE-284, which addresses improper access control issues, and demonstrates how weak database security controls can lead to complete system compromise. The flaw operates by allowing unauthorized network connections to the database port without implementing proper authentication checks or access controls. This creates an environment where remote adversaries can directly query, modify, or delete database entries without going through the legitimate application interfaces. The UniFi controller's database typically contains sensitive information including user credentials, network configurations, device management data, and operational parameters that control the entire wireless network infrastructure. When attackers can bypass normal application security controls to access the database directly, they gain unprecedented access to manipulate core network functions and potentially disrupt service availability.
The operational impact of this vulnerability extends far beyond simple data modification capabilities, as it enables attackers to fundamentally alter network configurations and user permissions. A successful exploitation could result in complete network disruption, unauthorized access to wireless networks, modification of security policies, or even the complete takeover of the UniFi controller. The vulnerability affects organizations that rely on Ubiquiti UniFi controllers for wireless network management, potentially exposing them to persistent threats that can remain undetected while attackers maintain unauthorized access to network infrastructure. This type of vulnerability is particularly dangerous in enterprise environments where UniFi controllers manage multiple access points, wireless networks, and user authentication systems, as the compromise of a single controller can impact entire organizational networks.
Organizations should implement immediate mitigations including network segmentation to isolate UniFi controllers from untrusted networks, enabling strong authentication mechanisms, and applying the latest firmware updates from Ubiquiti to address the vulnerability. The ATT&CK framework categorizes this type of vulnerability under privilege escalation and persistence tactics, as attackers can use direct database access to maintain long-term access to network infrastructure. Security monitoring should focus on unusual database connection patterns, unauthorized access attempts, and modifications to critical network configuration data. Additionally, implementing network access controls using firewalls to restrict database port access, enabling encrypted database connections, and regularly auditing database access logs can significantly reduce the risk of exploitation. Organizations should also consider implementing database activity monitoring solutions that can detect and alert on unauthorized database modifications, as this vulnerability specifically targets the database layer rather than application interfaces.