UniFi Protect AI Key CVE-2026-110457

The vendor states exploitation works only 'under certain conditions,' which is reflected in the CVSS AC:H rating, but the advisory does not name the specific configuration, feature state, or device mode required - this is the key unknown limiting a precise assessment. Confirmed prerequisites from the CVSS vector: the attacker needs network reachability to the UniFi Protect AI Key device (AV:N) but requires no authentication (PR:N) and no user interaction (UI:N). Limiting factors for defenders: the High attack complexity means exploitation is not reliable on demand, the impact is confined to disclosure of file information (C:L, no write or denial-of-service capability), and reaching the device typically requires being on the local management network rather than the open internet in most deployments.

This is a genuinely low-priority issue despite being network-reachable and unauthenticated. The CVSS 3.1 base score of 3.7 (vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a limited-impact path traversal: an attacker needs no privileges or user interaction, but attack complexity is High (AC:H) and the only impact is low-grade confidentiality (C:L) - read access to information about files on the device, with no integrity or availability impact. No EPSS score was provided in the input, there is no CISA KEV listing, and no public proof-of-concept was referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent rather than conflicting: a low CVSS, no KEV, and no POC all point the same direction. The AC:H metric aligns with the description's qualifier 'under certain conditions,' indicating exploitation is not reliable against arbitrary deployments. Net assessment: a real but minor information-disclosure flaw that should be patched in routine maintenance, not a drop-everything emergency.

An attacker with network access to a UniFi Protect AI Key device sends crafted requests containing directory-traversal sequences to a file-handling endpoint, and under specific conditions coaxes the device into disclosing information about files outside the intended directory. Because attack complexity is High, success likely depends on timing, configuration, or state that is not reliably present. No public proof-of-concept exploit was referenced in the available data.