UniFi Protect AI-Key CVE-2026-110454

The attacker must have network access to a reachable UniFi Protect AI Key device (the advisory text explicitly states 'a malicious actor with access to the network'); no authentication, credentials, or user interaction are required, matching PR:N/UI:N, and no non-default configuration is called out. The primary limiting factor is network reachability/adjacency to the device - an attacker without a route to the Protect AI Key's network segment cannot exploit this, so network segmentation and management-plane isolation materially reduce exposure. Impact is confined to unauthorized read-style access to internal resources (C:L), with no integrity or availability effect.

This is a moderate-severity Improper Access Control flaw (CWE-284) with a vendor-assigned CVSS 3.1 base score of 5.3 via vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The signals are internally consistent: network vector with low complexity and no privileges or user interaction required, but impact is limited to a low confidentiality breach (C:L) with no integrity or availability impact, which caps the score in the medium band. No EPSS score, CISA KEV listing, or public POC was provided, and there is no SSVC decision data; the only source is the Ubiquiti vendor advisory. This is therefore a genuine but bounded issue rather than a top-tier emergency - unauthenticated network-based access to internal resources is meaningful for lateral movement/reconnaissance, but the absence of integrity/availability impact and the lack of any exploitation evidence (no KEV, no POC) place it as a patch-in-normal-cycle priority rather than a drop-everything event. No key signals conflict; the main gap is the complete absence of exploitation-probability data (EPSS/KEV/POC all unknown), so real-world exploitation likelihood cannot be quantified from the input.

An attacker already positioned on the same network as a UniFi Protect AI Key sends requests to the device and, due to missing access-control enforcement, reaches internal resources or endpoints that should be restricted, enabling reconnaissance or information disclosure. Because CVSS indicates AV:N/AC:L/PR:N/UI:N, no authentication, special timing, or victim interaction is needed once network reachability exists. No public exploit code was identified at time of analysis.