EUVD-2026-22092
GHSA-6rpc-86fm-9prv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
9DescriptionCVE.org
A series of Improper Input Validation vulnerabilities could allow a Command Injection by a malicious actor with access to the UniFi Play network.
Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier) UniFi Play Audio Port (Version 1.0.24 and earlier)
Mitigation: Update UniFi Play PowerAmp to Version 1.0.38 or later Update UniFi Play Audio Port to Version 1.1.9 or later
AnalysisAI
Critical command injection in Ubiquiti UniFi Play PowerAmp and Audio Port allows remote unauthenticated attackers to execute arbitrary commands with network access to the device management interface. Affects PowerAmp versions ≤1.0.35 and Audio Port versions ≤1.0.24. CVSS 9.8 critical severity reflects network-accessible attack with no authentication barriers. EPSS score of 0.08% (24th percentile) suggests low immediate exploitation probability despite critical scoring. Vendor-released patches av
Technical ContextAI
The vulnerability stems from improper input validation (CWE-20) in UniFi Play network audio devices, specifically the PowerAmp and Audio Port products manufactured by Ubiquiti. These are networked audio management devices designed for commercial audio distribution systems. The input validation failures allow attackers to inject operating system commands through network-accessible interfaces. Command injection vulnerabilities typically arise when user-supplied data is passed to system shells without proper sanitization, allowing metacharacters (like semicolons, pipes, or backticks) to break out of intended command contexts and execute arbitrary code. The affected CPE identifiers (cpe:2.3:a:ubiquiti_inc:unifi_play_poweramp and cpe:2.3:a:ubiquiti_inc:unifi_play_audio_port) indicate these are application-level vulnerabilities in Ubiquiti's firmware. The CVSS vector AV:N indicates these devices expose vulnerable interfaces over the network, likely through web management consoles or API endpoints common in IoT audio equipment.
RemediationAI
Organizations should immediately upgrade affected devices to patched firmware versions. Vendor-released patch: upgrade UniFi Play PowerAmp to version 1.0.38 or later, and upgrade UniFi Play Audio Port to version 1.1.9 or later. Firmware updates should be obtained from Ubiquiti's official community portal at https://community.ui.com/releases/Security-Advisory-Bulletin-063/e468dd4b-5090-4ef8-89d8-939903c08e83. As interim risk mitigation if immediate patching is not feasible, restrict network access to UniFi Play device management interfaces using firewall rules or VLANs, ensuring only trusted administrative networks can reach these devices. Disable remote management features if not operationally required. Implement network monitoring to detect unusual command execution or outbound connections from these devices. Given the PR:N attack vector, no authentication-based controls will prevent exploitation, making patching the only complete remediation.
More in Unifi Play Poweramp
View allPath traversal in UniFi Play PowerAmp (≤1.0.35) and Audio Port (≤1.0.24) firmware allows unauthenticated remote attacker
Remote unauthenticated attackers can enable SSH and gain complete system control on Ubiquiti UniFi Play PowerAmp (≤1.0.3
Improper access control in Ubiquiti UniFi Play PowerAmp (≤1.0.35) and Audio Port (≤1.0.24) exposes WiFi credentials to n
Denial of service in Ubiquiti UniFi Play PowerAmp (≤1.0.35) and Audio Port (≤1.0.24) allows unauthenticated remote attac
Same weakness CWE-20 – Improper Input Validation
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today