UniFi Protect EUVD-2026-41383

The attacker must have network access to the UniFi Protect Application's data-streaming interface and the console must be running a version below 7.1.83; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity are required once that network path exists. The primary limiting factor is network reachability: UniFi Protect consoles are commonly deployed on internal/LAN segments, so exploitation typically requires the attacker to already be on the same LAN, VLAN, or VPN, or for the console's streaming interface to be exposed to the internet. There is no special product-feature toggle called out in the advisory beyond the affected data-streaming functionality, so default deployments below 7.1.83 that are network-reachable are exposed.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a trivially exploitable, unauthenticated network attack with high confidentiality, integrity, and availability impact. However, the signals partially conflict on real-world urgency: the SSVC framework rates Technical Impact as only 'partial' (not 'total') and Exploitation as 'none', which tempers the maximal C:H/I:H/A:H claim in the raw CVSS - the practical impact centers on unauthorized data-stream access rather than full system compromise. EPSS is low (0.27%, 19th percentile) and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation; there is no public exploit identified at time of analysis. That said, SSVC marks the flaw Automatable:yes, and the network vector with no privileges or user interaction means exploitation could scale quickly if a POC emerges. Net: a high-priority patch given the exposure and automatable nature, but current field-exploitation risk is low rather than an emergency.

An attacker who gains a foothold on the same network as a UniFi Protect console - for example via a compromised IoT device, guest Wi‑Fi, or an internet-exposed console - sends crafted requests to the streaming interface and receives protected camera data streams without supplying valid credentials. No public exploit is identified at this time, but the low attack complexity and lack of required authentication or user interaction make weaponization straightforward if the endpoint is reachable.