EUVD-2026-66404Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity access-control bypass yielding full device compromise; PR:L chosen because 'escalate privileges' implies some initial low-level access rather than fully anonymous entry.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device.
AnalysisAI
Privilege escalation in Ubiquiti's UniFi Protect AI Key lets a network-adjacent attacker abuse an improper access control (authentication-bypass) weakness to gain elevated privileges on the device, per Ubiquiti's own advisory (Security Advisory Bulletin 067). The CVSS 9.8 rating reflects a network-reachable, no-authentication, no-interaction path yielding full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the UniFi Protect AI Key device - the attacker must be able to send traffic to the device's management/service interface, which in typical deployments means presence on the LAN/VLAN hosting UniFi Protect cameras and controller rather than the public internet. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are partially consistent but incomplete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has gained a position on the same network segment as the UniFi Protect AI Key (for example via a compromised IoT host or rogue device on the surveillance VLAN) sends crafted requests to the device's exposed interface, bypassing access-control checks to obtain elevated privileges. With full control of the device the attacker can tamper with AI analytics, pivot within the surveillance network, or disrupt the Protect service. … |
| Remediation | Apply the firmware update referenced in Ubiquiti's Security Advisory Bulletin 067 (https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9); the input does not include an exact fixed version, so confirm the patched build number directly from that advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct inventory of all Ubiquiti UniFi Protect AI Key deployments and their network connectivity; immediately implement network segmentation restricting device access to authorized management subnets only, and enable comprehensive logging for all access attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today