UniFi Protect AI Key CVE-2026-110458

The vendor describes a path-traversal write/truncate primitive reachable by 'a malicious actor with access to the network and under certain conditions,' but does not name the specific feature, endpoint, or configuration involved, so the exact trigger is not disclosed. Limiting factors: the CVSS high attack complexity (AC:H) indicates a required but attacker-uncontrolled precondition (likely a race condition or specific device state), the impact is confined to creating or truncating files with only limited integrity effect (no code execution, data disclosure, or availability loss claimed), and the attacker must have network reachability to the UniFi Protect AI Key device. The precise conditions should be confirmed directly with Ubiquiti.

This is a low-priority issue that scores CVSS 3.7 (Low), and the available signals reinforce that rather than contradict it. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) describes a network-reachable, unauthenticated flaw, but with high attack complexity (AC:H) and only limited integrity impact (I:L) and no confidentiality or availability impact. The AC:H rating aligns with the vendor's own wording ('under certain conditions'), indicating the attacker does not fully control the preconditions and exploitation is not reliably repeatable. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit code was supplied, so exploitation status is: no public exploit identified at time of analysis. There is no SSVC decision data in the input. In short, the signals are consistent - a genuinely low-severity path-traversal write primitive with constrained impact - and this does not represent a high real-world risk despite being network-reachable and unauthenticated. The main caveat is that the single vendor advisory gives sparse detail ('under certain conditions'), so the exact preconditions should be confirmed with Ubiquiti.

A remote, unauthenticated attacker with network reachability to a UniFi Protect AI Key device sends crafted requests containing traversal sequences to a file-handling endpoint, and under specific timing or configuration conditions writes to or truncates a file outside the intended directory. Because attack complexity is high, the attacker likely must satisfy a race or environmental precondition, making reliable exploitation difficult. No public proof-of-concept exploit is identified at time of analysis.