What is the CVSS score of EUVD-2026-22095?

EUVD-2026-22095 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Unifi Play Poweramp are affected by EUVD-2026-22095?

Ubiquiti UniFi Play PowerAmp and Audio Port devices running vulnerable versions expose stored WiFi credentials to network-adjacent attackers, potentially compromising wireless network security across…. A patch is available.

How to fix or mitigate EUVD-2026-22095?

Within 24 hours: Identify all UniFi Play PowerAmp (≤1.0.35) and Audio Port (≤1.0.24) devices in your environment using asset inventory tools. Within 7 days: Apply vendor patch to all affected devices-upgrade PowerAmp to version 1.0.36 or later and Audio Port to version 1.0.25 or later. Within 30 days: Conduct WiFi credential audit to identify and rotate any credentials potentially exposed through affected devices; verify no unauthorized network access occurred during vulnerability window.

Unifi Play Poweramp EUVD-2026-22095

| CVE-2026-22566 HIGH

Improper Access Control (CWE-284)

2026-04-13 hackerone

GHSA-qg4j-p3wp-3c25

Authentication Bypass Ubiquiti Unifi Play Poweramp Unifi Play Audio Port Ubiquiti Inc

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 30, 2026 - 16:14 nvd

Patch available

Re-analysis Queued

Apr 17, 2026 - 15:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:57 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.0.38,1.1.9

Analysis Generated

Apr 15, 2026 - 12:36 vuln.today

EUVD ID Assigned

Apr 13, 2026 - 21:45 euvd

EUVD-2026-22095

Analysis Generated

Apr 13, 2026 - 21:45 vuln.today

CVE Published

Apr 13, 2026 - 21:28 nvd

HIGH 7.5

DescriptionCVE.org

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to obtain UniFi Play WiFi credentials.

Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier) UniFi Play Audio Port (Version 1.0.24 and earlier)

Mitigation: Update UniFi Play PowerAmp to Version 1.0.38 or later Update UniFi Play Audio Port to Version 1.1.9 or later

AnalysisAI

Improper access control in Ubiquiti UniFi Play PowerAmp (≤1.0.35) and Audio Port (≤1.0.24) exposes WiFi credentials to network-adjacent attackers without authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates remote exploitation with no authentication required, though the vulnerability description specifies 'access to the UniFi Play network' as a prerequisite. Reported via HackerOne bug bounty. EPSS score of 0.01% (1st percentile) suggests minimal observed exploitation activity, and no public exploit code or CISA KEV listing identified at time of analysis.

Technical ContextAI

This vulnerability affects Ubiquiti's UniFi Play audio streaming ecosystem, specifically the PowerAmp (hardware amplifier) and Audio Port (network audio adapter) products. The flaw is classified as CWE-284 (Improper Access Control), indicating insufficient enforcement of access restrictions to sensitive WiFi credential data. The affected CPE strings (cpe:2.3:a:ubiquiti_inc:unifi_play_poweramp and cpe:2.3:a:ubiquiti_inc:unifi_play_audio_port) confirm these are network-connected audio devices that rely on WiFi credentials for connectivity. The access control failure likely exists in the device's web management interface, API endpoints, or network service protocols that should authenticate and authorize requests before disclosing credentials. The CVSS confidentiality impact is High (C:H) with no integrity or availability impact, consistent with credential disclosure without system modification capabilities.

RemediationAI

Upgrade UniFi Play PowerAmp to version 1.0.38 or later and UniFi Play Audio Port to version 1.1.9 or later to remediate this vulnerability. Patches are available through Ubiquiti's standard firmware update mechanisms accessible via the UniFi management interface or device web UI. Consult Ubiquiti Security Advisory Bulletin 063 at https://community.ui.com/releases/Security-Advisory-Bulletin-063/e468dd4b-5090-4ef8-89d8-939903c08e83 for detailed update instructions. As an interim mitigation measure, isolate UniFi Play devices on dedicated management VLANs with strict access control lists, implement network segmentation to prevent unauthorized access to the UniFi Play network segment, and rotate WiFi credentials post-patching if unauthorized access is suspected. Organizations should audit which devices have network access to UniFi Play equipment and restrict to authorized management stations only.