UniFi Connect Display CVE-2026-77551

Exploitation requires network access to the UniFi Connect Display Cast Pro (AV:N) and is gated by unspecified 'certain conditions' that the vendor describes, reflected in the high attack complexity (AC:H) - meaning a specific device state, configuration, or timing must hold for the access-control bypass to succeed. No authentication is required per the vector (PR:N) and no user interaction is needed (UI:N). Limiting factors: the attacker must already be on a network path to the device (typically same LAN/VLAN, as this is a signage appliance not usually internet-exposed), and the non-trivial preconditions (AC:H) prevent reliable, one-shot exploitation against arbitrary deployments.

The signals are partly strong, partly incomplete. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H = 9.0) implies network reach, no authentication, full CIA impact and a scope change - but the high attack complexity (AC:H) and the description's phrase 'under certain conditions' both indicate exploitation is not turnkey. No EPSS score was provided, so probabilistic exploitation likelihood is unknown; there is no KEV listing and no POC in the data, so real-world exploitation is unproven. This reads as a genuinely high-severity but conditionally-exploitable flaw rather than a mass-exploited internet threat, especially given the product's niche footprint. Note a tension worth verifying with the vendor: the CVSS marks S:C (scope change) and PR:N, yet the description frames the outcome as 'escalate privileges on the device,' which often stays within a single security scope - the scope and privilege metrics may be more conservative in reality.

An attacker who has gained a foothold on the same LAN or VLAN as the UniFi Connect Display Cast Pro sends crafted requests to a network-exposed function that fails to properly enforce access control, and - once the required conditions are met - bypasses authentication to obtain elevated privileges on the device. From there they could tamper with displayed content, alter device configuration, or use the appliance as a pivot. No public exploit code is known, and the high attack complexity means the attacker must satisfy specific preconditions.