Unifi Play Poweramp CVE-2026-22562

Attacker requires network access to the UniFi Play device management interface, which in standard Ubiquiti deployments is accessible on the local network segment where devices are deployed. Exploitation does NOT require authentication (PR:N in CVSS vector), making any network-reachable device vulnerable. Default deployments typically restrict management interfaces to LAN-only access via UniFi controller segmentation, but misconfigurations exposing device management to guest networks, public Wi-Fi segments, or internet-facing interfaces eliminate this protection. No special firmware features or non-default settings required-vulnerability affects default firmware installations. Organizations using VLAN isolation or firewall rules that permit only Un

The CVSS 9.8 score reflects maximum impact across confidentiality, integrity, and availability with network-based unauthenticated attack vector (AV:N/AC:L/PR:N/UI:N), indicating this is exploitable remotely without credentials. However, real-world risk requires contextualization. The EPSS score of 0.11% (30th percentile) suggests security researchers and threat actors have not prioritized this vulnerability for active exploitation, likely because UniFi Play audio devices represent a narrow attack surface compared to enterprise infrastructure. The vulnerability is NOT listed in CISA KEV, confirming no confirmed active exploitation. SSVC decision factors: exploitation status is none/proof-of-concept absent, automatable is yes (network reachable, no auth), technical impact is total (RCE). The attack requires network access to the 'UniFi Play network'-interpretation critical: if this means the device management interface must be exposed (typically LAN-only in default deployments), the practical attack surface shrinks dramatically compared to internet-facing services. Priority should be medium-high for organizations with these devices on exposed networks, lower for air-gapped or strictly LAN-segmented deployments. The responsible disclosure via HackerOne and availability of patches before public disclosure reduces immediate risk.

An attacker on the same network segment as a UniFi Play device (or with routed access to the device management interface) sends crafted HTTP requests to the firmware's web service or management API, embedding directory traversal sequences in file upload or configuration parameters. The vulnerable firmware processes these malicious paths without sanitization, allowing the attacker to write a web shell, modified startup script, or cron job to /tmp, /etc/init.d, or other writable system directories. On next service restart or scheduled task execution, the injected code runs with system privileges, granting the attacker persistent remote code execution for data exfiltration, lateral movement to other network devices, or deployment of additional malware.