SMSMC Blog
Cyber Defense StrategyOctober 2026 · 5 min read

Securing the UniFi console itself: MFA, remote access, updates, admins and backups

One UniFi console can run your network, cameras and doors. Attackers know it. The account, update, admin and backup settings that keep it yours.

By Jim Venuto

One box, every door

A UniFi console is not just a router. Depending on the model, the same box runs UniFi Network, Protect (cameras) and Access (doors). Whoever controls it can open your Wi-Fi, watch or delete your video, and unlock your building.

On June 23, 2026, CISA added three UniFi OS vulnerabilities, CVE-2026-34908, CVE-2026-34909 and CVE-2026-34910, to its Known Exploited Vulnerabilities catalog. CISA describes an improper access control flaw, a path traversal flaw and an input validation flaw that allow a malicious actor with network access to make unauthorized changes, reach files on the system, or inject commands. The catalog links Ubiquiti’s fix in Security Advisory Bulletin 064 (CISA KEV catalog; Ubiquiti Security Advisory Bulletin 064).

KEV-listed flaws are the ones being used. A console that hadn’t been updated in June was exposed to them.

Why consoles get neglected

  • The installer set it up and left. The owner account is in the installer’s name, or a former employee’s.
  • “It’s working” means nobody looks. Auto-updates were never checked, and backups were never tested.
  • Everyone is a Super Admin because that was the fastest way to give access.

The design: own it, limit it, update it, back it up

SMC’s preferred platform is UniFi, and these controls are part of every UniFi design SMC specifies. The same principles apply to whatever console runs a business’s existing system.

1. The business owns the owner account

The Owner is the account that set up the console and has the highest access (UniFi Roles Explained). It should belong to the business: a UI Account registered to a company mailbox that two people can reach, not an installer’s account or someone’s personal email.

That matters for recovery. Ubiquiti says it cannot reset multi-factor authentication; if you lose all your methods, you have to create a new account (Multi-Factor Authentication). Set up more than one method and store the backup recovery codes somewhere the business controls.

2. Strong MFA on every admin

Ubiquiti has required MFA on UI Accounts since July 22, 2024; accounts with no other method were switched to email codes (Multi-Factor Authentication). Email codes are only as safe as the mailbox. Ubiquiti recommends its UI Verify app, or a standard authenticator app. Move every admin to an app.

Note the exception in the same article: MFA does not apply to logging in to a device locally with local credentials. Keep local accounts few, with long unique passwords in a password manager.

3. Fewest admins, smallest roles

Super Admins have full access to a site, and Ubiquiti says they “should be considered equivalent to Owners from a security perspective.” Narrower roles exist, such as Hotspot Operator for guest Wi-Fi and Door Attendant for opening doors and talking to visitors (UniFi Roles Explained).

  • Two Super Admins at most, named, both on app-based MFA.
  • Everyone else gets the narrowest role that does the job.
  • When an installer or IT provider finishes, change their access to what the support contract covers, or remove it. Review the admin list every quarter.

4. Remote access without open ports

Manage remotely through Site Manager at unifi.ui.com, which Ubiquiti says encrypts data in transit (UniFi Remote Management via Site Manager). Don’t forward ports to the console’s management page. If Direct Remote Connection is turned on for performance, know that it needs a public IP and TCP port 443 on the gateway, and include it in your firewall review.

5. Updates on, and someone watching

Auto-updates and the release channel (Official or Early Access) are set per console and application under Settings > Control Plane > Updates, and Site Manager’s Update Manager shows every site in one place (UniFi Updates). For a business: Official channel, auto-updates on, scheduled outside business hours, and one named person who reads Ubiquiti’s security advisory bulletins and checks that each critical fix actually installed.

6. Backups you have tested

Turn on automated System Backups under Settings > Control Plane > Backups. Ubiquiti says these cloud backups are made weekly and before each major update, include OS, application and device configuration, and can only be managed by the console Owner (Backups and Migration in UniFi). Download an offline backup after any significant change and store it with your other business records.

Two cautions. A configuration backup is not a video backup: Protect recordings stay on the recorder’s drives. And an untested backup is a hope; restore one to spare hardware, or at least walk through the restore screens, once a year.

7. Put the console behind a door

Physical access is admin access. Rack or closet, locked, on battery backup, not in the reception area.

Checklist

  • Owner account belongs to the business, on a shared company mailbox
  • Two or more MFA methods on the Owner; recovery codes stored by the business
  • Every admin on app-based MFA, not email codes
  • No more than two Super Admins; everyone else in a narrower role
  • Installer and former staff access removed or reduced; quarterly admin review
  • No port forwards to the console; Direct Remote Connection reviewed if used
  • Auto-updates on (Official channel); a named person checks Ubiquiti advisories
  • Automated backups on; offline copy kept; one restore test a year
  • Console in a locked space on battery backup

When to get help

SMC reviews existing UniFi consoles against this list, designs new systems with these controls in the specification, and checks an installer’s finished work against it. SMC doesn’t sell equipment or take commissions. UniFi is our preferred platform; if you run a different system that fits, we apply the same review to it.

Start with the free security assessment at https://www.securitymedic.com/assessment. You get a gap report to keep and a free results review; physical security questions are also covered on a free 30-minute call.

Sources

Tags#physical-security#smb#ubiquiti#checklist