Unifi Play Poweramp CVE-2026-22566

Attacker must have network connectivity to the UniFi Play network segment where PowerAmp or Audio Port devices are deployed. This requires the attacker to be on the same Layer 2 broadcast domain or have routed access to the management interface subnet of the UniFi Play devices. While CVSS vector indicates AV:N (network attack vector), the vulnerability description specifies 'access to the UniFi Play network' as a concrete prerequisite, meaning exploitation is not possible from the public internet without first compromising an asset on the target network or connecting to an exposed network segment where these devices reside.

The vulnerability presents a nuanced risk profile requiring careful contextual analysis. The CVSS base score of 7.5 (High) reflects the network attack vector (AV:N), low complexity (AC:L), and no authentication requirement (PR:N), suggesting easy exploitation. However, the vulnerability description specifies 'access to the UniFi Play network' as a prerequisite, which contradicts the AV:N vector and implies network adjacency constraints-attackers must already be on the same network segment as the UniFi Play devices. This significantly reduces real-world exploitability compared to internet-facing vulnerabilities. The EPSS score of 0.01% (1st percentile) aligns with limited threat actor interest, likely due to the niche target (audio equipment in enterprise/prosumer environments) and network adjacency requirement. No CISA KEV listing or public exploit code exists. SSVC decision factors: exploitation status is none detected, technical impact is partial (credential theft enables lateral movement but not immediate system compromise), and automatable is yes (once network access achieved). Real-world priority depends heavily on deployment context-high risk in environments where UniFi Play devices are on untrusted network segments, low risk when properly segmented on management VLANs. The credential disclosure could enable wider network compromise if the same WiFi credentials are reused across infrastructure.

An attacker connected to the same network segment as UniFi Play devices (for example, a guest WiFi network or compromised employee workstation) sends unauthenticated HTTP/HTTPS requests to the device management interface or API endpoints. The improper access control allows retrieval of stored WiFi credentials without authentication. The attacker uses these credentials to connect additional devices to the corporate WiFi network, enabling lateral movement, network reconnaissance, or man-in-the-middle attacks against other network resources. No public proof-of-concept code identified, but exploitation complexity is low given the lack of authentication requirements.