UniFi Protect EUVD-2026-66378

Exploitation requires network reachability to the UniFi Protect Application interface plus a valid low-privilege Protect account (CVSS PR:L) - it is not an unauthenticated attack; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The concrete prerequisite is authenticated access to a Protect input field/endpoint that forwards data into a host command, per the Improper Input Validation/Command Injection description. Limiting factors that reduce real-world risk: the attacker must already possess credentials for at least a low-privilege account, and must be able to reach the Protect management network - appliances kept on isolated VLANs with no exposed remote access and no untrusted low-privilege accounts are substantially harder to exploit.

The signals point to a genuinely high priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) shows remote, low-complexity exploitation needing only low privileges, no user interaction, and a scope change yielding total confidentiality, integrity, and availability loss on the host - hence the 9.9 rating. The main mitigating factor is PR:L: an attacker must first hold a low-privilege UniFi Protect account (or credentials for one), so this is not fully unauthenticated. No EPSS score was provided in the input, so exploitation-probability modeling is unavailable, and there is no KEV listing or POC evidence, indicating no confirmed in-the-wild use yet. Net: a critical, easily weaponizable authenticated flaw whose real-world exposure depends heavily on how tightly Protect accounts and management-network access are controlled; the absence of EPSS/KEV data should be treated as 'not yet observed,' not 'low risk.'

An attacker who has obtained a low-privilege UniFi Protect account (for example a limited camera-viewer login, reused credentials, or an insider) sends a crafted request containing shell metacharacters to a Protect application input that is passed into a host command. The malformed input is executed on the underlying UniFi OS host, giving the attacker code execution outside the application sandbox and full control of the NVR, including stored footage and network management. No public exploit is identified at this time, but the low attack complexity makes reliable exploitation straightforward once account access exists.