UniFi Protect CVE-2026-54407

The attacker requires network-level access to reach the UniFi Protect Application's affected API endpoints (per the description, 'access to the network'), and the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity are needed once those endpoints are reachable. The specific prerequisite is thus reachability of the vulnerable Protect API - practically limited by whether the console/API is exposed to the internet, segmented behind a management VLAN, or accessible only via VPN. The primary limiting factor is network exposure rather than any special product feature or non-default setting, since the flaw affects the Protect application's own endpoints; the description does not name a specific optional feature that must be enabled.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, score 8.6) describes an easy-to-reach, unauthenticated, no-interaction bug - the classic profile of an exposed authentication bypass - with the severity driven mainly by high availability impact (A:H) alongside limited confidentiality and integrity effects. No EPSS score, SSVC decision, KEV entry, or POC was provided in the input, so exploitation likelihood cannot be quantified from these signals; the absence of KEV and POC data means there is no confirmed active exploitation. The main real-world risk hinges on network exposure: UniFi Protect management is typically LAN- or VPN-restricted, which materially limits AV:N in practice, but consoles that are remotely accessible (or reachable by an attacker who already has a network foothold) face genuine unauthenticated risk. Note the qualifier 'access to the network' in the description aligns with AV:N but does not by itself confirm internet exposure - verify each deployment's exposure before prioritizing.

An attacker who has network reach to a UniFi console - for example a foothold on the same LAN/VLAN or an internet-exposed console - sends crafted requests directly to the affected UniFi Protect API endpoints without authenticating. Because the access-control check is missing, the endpoints respond, letting the attacker invoke protected functionality and potentially disrupt Protect services (consistent with the A:H impact). No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means no special timing or configuration is needed once the endpoint is reachable.