EUVD-2026-22094
GHSA-hj6r-ww52-66xr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessNetwork access to UniFi Play device
-
DeliverySend malformed input to management interface
-
ExploitTrigger input validation flaw
-
ExecutionDevice becomes unresponsive
-
ImpactAvailability impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Attacker must have network access to the UniFi Play network. Affects UniFi Play PowerAmp version 1.0.35 and earlier, and UniFi Play Audio Port version 1.0.24 and earlier. No authentication or user interaction required. |
| Impact | While the CVSS base score of 7.5 (High) reflects significant availability impact, multiple risk signals indicate limited real-world urgency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H shows network-accessible denial of service with low attack complexity and no authentication required, suggesting easy exploitability for availability disruption. However, the EPSS score of 0.01% (1st percentile) indicates statistical models predict minimal likelihood of active exploitation, likely because these are specialized audio equipment devices with limited deployment compared to general IT infrastructure. The scope remains unchanged (S:U), meaning the vulnerability cannot be leveraged to attack other systems, and impact is purely availability-based with no confidentiality or integrity compromise. No KEV listing or public POC exists, further supporting lower real-world risk. From an SSVC perspective, technical impact is partial (availability only), exploitation is not observed in the wild, and automation potential is high but value is low given the limited attack surface. This represents a moderate priority for organizations using these specific Ubiquiti audio products but not a critical emergency requiring immediate action across broader security programs. |
| Exploit ScenarioDerived | An unauthenticated attacker on the same network segment as UniFi Play audio devices sends specially crafted malformed packets to the device's management interface or API endpoint. The improper input validation flaw causes the device firmware to crash or enter an unresponsive state, disrupting audio distribution services and requiring manual device reboot or power cycling to restore functionality. This could be leveraged as part of a broader disruption campaign against facilities relying on these devices for commercial audio systems. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 15, 2026
Denial of service in Ubiquiti UniFi Play PowerAmp (≤1.0.35) and Audio Port (≤1.0.24) allows unauthenticated remote attackers to crash devices via improper input validation. CVSS 7.5 (High) with network-based attack requiring no privileges or user interaction. EPSS score of 0.01% (1st percentile) indicates minimal real-world exploitation likelihood. No public exploit identified at time of analysis. Vendor-released patches available: PowerAmp 1.0.38+ and Audio Port 1.1.9+.
RemediationAI
Update UniFi Play PowerAmp to firmware version 1.0.38 or later, and update UniFi Play Audio Port to firmware version 1.1.9 or later. Firmware updates should be obtained through the official Ubiquiti UniFi management console or downloaded directly from Ubiquiti's support portal. Consult the vendor's Security Advisory Bulletin 063 at https://community.ui.com/releases/Security-Advisory-Bulletin-063/e468dd4b-5090-4ef8-89d8-939903c08e83 for detailed upgrade instructions and release notes. As an interim workaround until patching is completed, network segmentation can reduce exposure by restricting access to these devices to trusted management networks only, blocking external or untrusted network access to the device management interfaces via firewall rules or VLAN isolation. No alternative workarounds are documented by the vendor, making firmware updates the definitive remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects Ubiquiti's UniFi Play audio networking equipment, specifically the PowerAmp and Audio Port products which provide networked audio distribution capabilities. The root cause is CWE-20 (Improper Input Validation), where the devices fail to properly sanitize or validate network input before processing. This input validation weakness allows malformed or crafted packets to trigger an unhandled exception or resource exhaustion condition, causing the device firmware to enter an unresponsive state. The affected CPE strings (cpe:2.3:a:ubiquiti_inc:unifi_play_poweramp and cpe:2.3:a:ubiquiti_inc:unifi_play_audio_port) confirm these are application-layer vulnerabilities in the device management interfaces rather than hardware flaws. The network attack vector (AV:N) suggests the vulnerability exists in a remotely-accessible service, likely the device's web management interface or API endpoint used for configuration and control of the audio networking features.
Know when Unifi Play Poweramp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
An Improper Input Validation vulnerability could allow a malicious actor with access to the UniFi Play network to cause the device to stop responding.
Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier) UniFi Play Audio Port (Version 1.0.24 and earlier)
Mitigation: Update UniFi Play PowerAmp to Version 1.0.38 or later Update UniFi Play Audio Port to Version 1.1.9 or later
Executive ViewAI
Ubiquiti UniFi Play PowerAmp and Audio Port devices running outdated firmware versions are vulnerable to unauthenticated remote denial-of-service attacks that can crash affected hardware. Organizations deploying these audio infrastructure components should prioritize firmware updates to prevent service disruptions, particularly in facilities relying on UniFi Play systems for critical audio distribution.
Apply vendor patch. If immediate patching is not feasible, implement network-level access controls to restrict inbound traffic to affected devices to trusted management networks only, and monitor device logs for unexpected reboots or connectivity loss.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Unifi Play Poweramp
View allPath traversal in UniFi Play PowerAmp (≤1.0.35) and Audio Port (≤1.0.24) firmware allows unauthenticated remote attacker
Critical command injection in Ubiquiti UniFi Play PowerAmp and Audio Port allows remote unauthenticated attackers to exe
Remote unauthenticated attackers can enable SSH and gain complete system control on Ubiquiti UniFi Play PowerAmp (≤1.0.3
Improper access control in Ubiquiti UniFi Play PowerAmp (≤1.0.35) and Audio Port (≤1.0.24) exposes WiFi credentials to n
Exploit-DB