UniFi AV Bridge CVE-2026-77552

Exploitation requires network reachability to the UniFi Enterprise Audio/Video Bridge and the ability to send input to the vulnerable, network-facing service; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are documented as prerequisites - the flaw is exploitable against reachable devices. The primary limiting factor is network position: as an enterprise AV appliance, the device is normally deployed on internal or management networks rather than the public internet, so an attacker generally needs an existing foothold on, or bridged access to, the same segment. The exact vulnerable firmware versions are not specified in the provided data (CPE version is wildcarded), so version-based scoping is unconfirmed.

The signals point to a genuinely high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with no user interaction, and the C:H/I:H/A:H impact reflects full device takeover - a profile that argues for prompt patching. Countervailing context: this CVE is NOT in CISA KEV, no proof-of-concept or public exploit was identified in the provided data, and no EPSS score was supplied, so there is no evidence of active or at-scale exploitation yet - the urgency derives from the intrinsic severity and ease of exploitation, not from observed attacks. Because these devices sit on internal or management networks rather than the open internet, the realistic threat model is an attacker who has already gained a foothold on the LAN or an untrusted device sharing the segment; any operator running this appliance should treat it as urgent and patch quickly while limiting exposure. Note the wildcarded CPE means affected version ranges are unconfirmed, so patch planning should rely on Ubiquiti's advisory rather than inferred version boundaries.

An attacker who has gained access to the same network segment as the AV Bridge (for example, via a compromised workstation or a rogue device on the LAN) sends a crafted request to a network-exposed service on the device, embedding shell metacharacters in an improperly validated field. The unsanitized input reaches an OS command context and executes with device privileges, giving the attacker code execution on the appliance. No authentication or user interaction is required per the CVSS vector, and no public PoC was identified at time of analysis.