UniFi Talk Application EUVD-2026-41390

Exploitation requires an authenticated session with at least a low-privileged UniFi Talk Application account (CVSS PR:L) and network reachability to the Talk application interface (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L). The concrete prerequisite is valid low-privilege credentials to the UniFi Talk app, after which the attacker submits malicious input to the SQL-injection-affected Talk endpoints. The primary limiting factor is that anonymous/unauthenticated attackers cannot exploit this - an account (or credential theft/insider access) is mandatory - which narrows the realistic attacker set to users who already have some access to the Talk deployment.

The signals are mostly aligned toward high real-world risk but incomplete. CVSS 3.1 is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): network-reachable, low complexity, only low privileges required, no user interaction, and a scope change with full CIA impact on the host - a genuinely severe profile. However, PR:L means this is NOT unauthenticated: an attacker must already possess a valid low-privileged account, which meaningfully limits opportunistic mass exploitation. No EPSS score is provided in the input, so exploitation probability cannot be quantified. It is not in CISA KEV (no confirmed active exploitation) and no POC is referenced, so the practical urgency rests on the low authentication bar rather than on evidence of exploitation in the wild. Net: a real priority for anyone exposing UniFi Talk to semi-trusted users, but the required authentication tempers it below a wormable/unauthenticated RCE.

An attacker who has obtained a low-privileged UniFi Talk account - for example a rank-and-file phone user or a compromised employee login - sends crafted input to a vulnerable Talk endpoint that is concatenated into a backend SQL query. By chaining the SQL injection flaws, the attacker manipulates the database and leverages the trusted execution context to escalate to host-level privileges on the UniFi device. No public POC is referenced, and the network vector with low complexity means the sequence requires only valid credentials and standard HTTP access to the application.