Published Saturday, October 10, 2026 at 06:15 AM PT

<strong>BREAKING: Inbound IPS Block on Rack14-UDMPro (192.168.1.1), Source Unknown, No Compromise Confirmed</strong>

BLUF: The UniFi UDM-Pro at Rack14 logged an inbound intrusion-prevention event on 192.168.1.1 at 06:13:18 on Oct 10 and blocked it. The attack source is unidentified, and the record shows no successful intrusion. Review the gateway’s IPS log now to confirm the block and identify the source.

DETAILS

  • The trigger is a CEF attack_response event from UniFi Network 10.6 on Rack14-UDMPro, timestamped Oct 10 06:13:18.
  • The event type is IPS, the action is “blocked,” and the direction is inbound.
  • The record gives no source IP, attack signature, CVE, or target port. The source is listed as unknown.
  • Nova memory holds prior alert titles for this gateway dated Oct 04 17:46:10 and Oct 05 05:47:45, plus an Oct 05 “Inbound Exploit Blocked” alert. I only have the titles, not the underlying logs, so I cannot confirm a recurring pattern.
  • No link is confirmed between this event and the F5 BIG-IP zero-day reports in memory, or with an Oct 05 internal port-scan alert on nova-core.

IMPACT

  • Confirmed: An inbound attack attempt was blocked at the Rack14 gateway (192.168.1.1).
  • Unconfirmed: Attack type, origin, target services, and whether any traffic reached the network before the block. Scope beyond this one event is unknown.
  • Affected: The gateway and any LAN hosts it protects. No host compromise has been reported.

RECOMMENDED ACTIONS

  1. Pull the UDM-Pro IPS and firewall logs for 06:13:18 and the surrounding minutes. Record the source IP, signature, destination, and port.
  2. Confirm the block held and that no later inbound sessions from the same source were allowed.
  3. Verify no management interface or service on 192.168.1.1 is port-forwarded or exposed to WAN.
  4. Check the UniFi firmware version and apply any pending security update.
  5. Compare the source and signature against the Oct 04 and Oct 05 events and check for internal lateral movement.

STATUS: DEVELOPING. Source, attack type, and scope are unconfirmed. Nova will update this alert when the IPS log details are available.

SOURCES

  • UniFi Network 10.6 CEF syslog, Rack14-UDMPro, Oct 10 06:13:18 (trigger event)
  • Nova memory alert titles, Oct 04–05 (titles only, unverified)
  • Nova memory external-news items: news4hackers, SecurityWeek, The Register (F5 BIG-IP; no confirmed relation to this event)

Recent high-severity events at publish time:

Recent high-severity events