Unifi Play Poweramp EUVD-2026-22093

Network access to the UniFi Play device management interface on TCP ports 80/443 or the device's proprietary management port. The vulnerability specifically affects the SSH enablement functionality accessible through the web management interface. Exploitation succeeds against default configurations of UniFi Play PowerAmp (≤1.0.35) and UniFi Play Audio Port (≤1.0.24) without requiring valid administrator credentials, special feature enablement, or non-standard deployment modes. Devices isolated to properly segmented management VLANs with restricted firewall policies would not be accessible to remote internet-based attackers but remain vulnerable to insider threats or attackers with existing network presence.

The CVSS 9.8 Critical rating reflects maximum theoretical impact (network-accessible, unauthenticated, affects all CIA triad elements), but real-world risk indicators paint a more nuanced picture. EPSS probability of 0.01% (3rd percentile) suggests security researchers and threat actors have shown minimal exploitation interest in the three weeks since disclosure. No confirmed active exploitation exists (not listed in CISA KEV), and no public proof-of-concept code has been identified. The SSVC decision framework would classify this as 'Attend' rather than 'Act Immediately': exploitation is possible but not demonstrated (PoE: none), the attack cannot be reliably automated at scale given the requirement to identify specific Ubiquiti audio devices on target networks, and technical impact is total system compromise. Primary risk exists in environments where UniFi Play devices are directly exposed to untrusted networks (internet-facing management interfaces, guest networks) rather than properly segmented audio VLANs. Organizations following network segmentation best practices face significantly reduced exposure, as the attacker requires existing network access to the management plane. The 'Authentication Bypass' tag confirms this is a true pre-auth vulnerability, elevating priority for internet-exposed deployments.

An attacker on the same network as UniFi Play devices (corporate LAN, guest Wi-Fi, or internet if devices have public IPs) sends crafted HTTP/HTTPS requests to the device management interface to enable the SSH service without providing valid credentials. Once SSH is activated, the attacker establishes an SSH session using default, weak, or brute-forced credentials, gaining root shell access. From this position, the attacker modifies system configurations, implants persistent backdoors, intercepts audio streams, pivots to other network segments, or disrupts audio operations across the commercial installation.