EUVD-2026-22091
GHSA-vpqx-f7gf-qp3x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
9DescriptionCVE.org
A malicious actor with access to the UniFi Play network could exploit a Path Traversal vulnerability found in the device firmware to write files on the system that could be used for a remote code execution (RCE).
Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier) UniFi Play Audio Port (Version 1.0.24 and earlier) Mitigation: Update UniFi Play PowerAmp to Version 1.0.38 or later Update UniFi Play Audio Port to Version 1.1.9 or later
AnalysisAI
Path traversal in UniFi Play PowerAmp (≤1.0.35) and Audio Port (≤1.0.24) firmware allows unauthenticated remote attackers to write arbitrary files for remote code execution. CVSS 9.8 critical severity reflects network-accessible attack requiring no authentication or user interaction. EPSS score of 0.11% (30th percentile) suggests low immediate exploitation probability despite critical rating. No public exploit identified at time of analysis. Reported via HackerOne bug bounty, vendor patches avai
Technical ContextAI
This vulnerability exploits CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal or directory traversal. The affected products-Ubiquiti UniFi Play PowerAmp and Audio Port devices-are network-connected audio equipment deployed in commercial and residential installations. The flaw resides in the device firmware's file handling routines, which fail to properly sanitize file path inputs. Attackers can use directory traversal sequences (e.g., '../../../') to escape restricted directories and write files to arbitrary locations on the underlying Linux-based operating system. By writing malicious files to executable paths, startup scripts, or web application directories, attackers can achieve persistent remote code execution with the privileges of the firmware process (likely root or system-level). The CPE identifiers (cpe:2.3:a:ubiquiti_inc:unifi_play_poweramp and cpe:2.3:a:ubiquiti_inc:unifi_play_audio_port) confirm these are embedded device firmwares, not traditional server applications, making filesystem-level access particularly dangerous.
RemediationAI
Vendor-released patches are available: upgrade UniFi Play PowerAmp to firmware version 1.0.38 or later, and upgrade UniFi Play Audio Port to firmware version 1.1.9 or later. Firmware updates should be applied via the UniFi controller interface or device management console following standard Ubiquiti update procedures. Until patching is complete, implement network-level mitigations: restrict access to device management interfaces using firewall rules or VLANs to trusted administrator networks only, disable remote management if not required, and monitor device logs for unusual file write operations or unexpected network connections. Organizations without immediate patching capability should air-gap affected devices from untrusted networks. Detailed update instructions and firmware downloads available in Ubiquiti Security Advisory Bulletin 063: https://community.ui.com/releases/Security-Advisory-Bulletin-063/e468dd4b-5090-4ef8-89d8-939903c08e83. Verify firmware versions post-update and audit network segmentation policies for embedded audio/IoT devices.
More in Unifi Play Poweramp
View allCritical command injection in Ubiquiti UniFi Play PowerAmp and Audio Port allows remote unauthenticated attackers to exe
Remote unauthenticated attackers can enable SSH and gain complete system control on Ubiquiti UniFi Play PowerAmp (≤1.0.3
Improper access control in Ubiquiti UniFi Play PowerAmp (≤1.0.35) and Audio Port (≤1.0.24) exposes WiFi credentials to n
Denial of service in Ubiquiti UniFi Play PowerAmp (≤1.0.35) and Audio Port (≤1.0.24) allows unauthenticated remote attac
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today