Unifi Play Poweramp CVE-2026-22563

Network access to the UniFi Play device management interface is required (CVSS AV:N indicates network-accessible attack surface). The vulnerability is exploitable against default configurations with no authentication required (PR:N). The description specifies 'access to the UniFi Play network' as the prerequisite, meaning attackers must be able to reach the network segment where these devices are deployed. This typically means presence on the corporate LAN, WiFi network, or any routed network path to the devices' IP addresses. No special product features, non-default configurations, or administrative privileges are required beyond basic network connectivity to the vulnerable management interfaces.

This vulnerability presents a paradox between severity metrics and exploitation likelihood. The CVSS 9.8 critical score reflects worst-case impact: network-based attack (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). However, EPSS probability of 0.08% (24th percentile) suggests attackers are not actively targeting this vulnerability, likely due to limited deployment of UniFi Play audio products compared to mainstream IT infrastructure. The report from HackerOne indicates responsible disclosure, and absence from CISA KEV confirms no confirmed active exploitation. Real-world risk depends heavily on deployment context: organizations with UniFi Play devices exposed to untrusted networks face immediate critical risk requiring urgent patching. However, these devices are typically deployed on internal corporate or venue networks with network segmentation, significantly reducing attack surface. The automatable nature (no authentication, low complexity) means exploitation could be weaponized rapidly if attacker interest emerges. Priority should be high for organizations using these products, but broader enterprise risk is limited by narrow attack surface compared to ubiquitous software vulnerabilities.

An attacker on the same network as UniFi Play devices (or with routed access if exposed) sends specially crafted HTTP requests to the device's web management interface or API endpoints. By injecting shell metacharacters into input fields that are improperly validated, the attacker escapes the intended command context and executes arbitrary operating system commands with the privileges of the device firmware (typically root on embedded Linux systems). The attacker could install persistent backdoors, exfiltrate network credentials, pivot to other network segments, or use the compromised audio devices as footholds for lateral movement in the corporate network.