UniFi Protect Floodlight EUVD-2026-41393

Exploitation requires network-level access to the UniFi Protect Floodlight device - the attacker must be able to reach the device's file-serving endpoint on the local/management network (the description explicitly scopes it to 'a malicious actor with access to the network'). No authentication is needed (CVSS PR:N) and no user interaction is required (UI:N), and attack complexity is low (AC:L), so once network reachability exists, exploitation is straightforward against affected firmware. The primary limiting factor is that the device is not typically exposed directly to the public internet; realistic risk therefore depends on how segmented and access-controlled the UniFi Protect network is. Impact is limited to reading files (C:H, I:N, A:N) - it does not by itself grant code execution or device modification.

Signals are moderate and largely consistent. The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) reflects an unauthenticated, low-complexity, network-reachable read primitive with high confidentiality but no integrity or availability impact - a serious information-disclosure issue rather than full compromise. However, 'network' here is qualified by the description's phrasing 'a malicious actor with access to the network,' implying practical exploitation requires being on the same LAN/management network as the floodlight rather than exposure across the open internet; this tempers the real-world attack surface relative to a raw AV:N reading. EPSS and SSVC data were not provided, so exploitation probability and automatability cannot be quantified here. There is no KEV listing and no evidence of a public PoC, so this is a credible but not urgent priority: patch promptly, especially where the management network is broad or shared, but it is not currently under known active exploitation.

An attacker who has gained a foothold on the LAN or Wi-Fi segment where a UniFi Protect Floodlight resides sends a crafted request to the device's file-handling endpoint containing directory-traversal sequences (e.g., '../../') to escape the intended directory. The device returns the contents of arbitrary local files, potentially leaking configuration, credentials, or other sensitive data. No public exploit code has been identified, and exploitation requires low complexity and no authentication per the CVSS vector.