EUVD-2026-66404
GHSA-4jjr-c27v-p3c2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain access to device network segment
-
DeliveryReach AI Key management interface
-
ExploitBypass improper access control check
-
ExecutionEscalate privileges on device
-
ImpactControl UniFi Protect AI Key
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the UniFi Protect AI Key device - the attacker must be able to send traffic to the device's management/service interface, which in typical deployments means presence on the LAN/VLAN hosting UniFi Protect cameras and controller rather than the public internet. The CVSS vector (PR:N/UI:N/AC:L) indicates no authentication, no user interaction, and low complexity against the affected device, so the main limiting factor is network position/adjacency and whether the device interface is segmented away from untrusted hosts. Note the description's 'escalate privileges' wording may imply the attacker leverages existing low-level device or network access as the starting point - confirm the exact precondition against Security Advisory Bulletin 067. |
| Impact | Signals are partially consistent but incomplete. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes remote, unauthenticated, low-complexity exploitation with total device compromise, which aligns with the 'Authentication Bypass' tag and the CWE-284 root cause. However, EPSS data was not provided, there is no SSVC decision record, no POC is referenced, and KEV status is not listed - so exploitation probability cannot be quantified from this input. One tension worth verifying: the vector encodes PR:N (unauthenticated) while the description frames the outcome as 'escalate privileges,' which can imply the attacker already holds some foothold or lower-privilege access; the raw score should be treated as the vendor's worst-case assessment until the advisory detail is confirmed. Net: treat as a high priority for anyone running the AI Key device, but recognize real-world urgency (widespread vs. targeted) is unquantified without EPSS/KEV. |
| Exploit ScenarioDerived | An attacker who has gained a position on the same network segment as the UniFi Protect AI Key (for example via a compromised IoT host or rogue device on the surveillance VLAN) sends crafted requests to the device's exposed interface, bypassing access-control checks to obtain elevated privileges. With full control of the device the attacker can tamper with AI analytics, pivot within the surveillance network, or disrupt the Protect service. No public exploit code is referenced, and low attack complexity (AC:L) means a working technique would be straightforward to reuse once known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Privilege escalation in Ubiquiti's UniFi Protect AI Key lets a network-adjacent attacker abuse an improper access control (authentication-bypass) weakness to gain elevated privileges on the device, per Ubiquiti's own advisory (Security Advisory Bulletin 067). The CVSS 9.8 rating reflects a network-reachable, no-authentication, no-interaction path yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Apply the firmware update referenced in Ubiquiti's Security Advisory Bulletin 067 (https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9); the input does not include an exact fixed version, so confirm the patched build number directly from that advisory before deploying. Because the flaw is network-exploitable and unauthenticated, the primary compensating control until patching is network segmentation: place the UniFi Protect AI Key and its controller on a dedicated management VLAN and restrict inbound access with firewall rules so only the UniFi Protect controller and trusted admin hosts can reach the device - the trade-off is that overly strict rules can break controller-to-device discovery/analytics, so validate Protect functionality after locking down. Additionally disable or block any remote/WAN exposure of the device management interface; the side effect is loss of remote administration, which is acceptable given the severity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the UniFi Protect AI Key (cpe:2.3:a:ubiquiti_inc:unifi_protect_ai_key), a Ubiquiti accessory that adds AI-assisted analytics capabilities to the UniFi Protect video/NVR ecosystem. The root cause is classified as CWE-284 (Improper Access Control), meaning an authorization decision is missing or incorrectly enforced on a network-exposed function; the vendor tag 'Authentication Bypass' indicates an attacker can reach privileged functionality without proper credentials. Because these devices typically sit on the same LAN/VLAN as cameras and the UniFi Protect controller, the exposed interface is reachable by any host that can route to the device.
Know when Unifi Protect Ai Key gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity access-control bypass yielding full device compromise; PR:L chosen because 'escalate privileges' implies some initial low-level access rather than fully anonymous entry.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device.
Executive ViewAI
Ubiquiti UniFi Protect AI Key contains a critical authentication bypass enabling unauthenticated network attackers to gain full administrative control of the device without any credentials or user interaction required. This directly compromises the integrity, availability, and confidentiality of enterprise surveillance infrastructure and any protected data processed by affected systems.
Network segmentation restricting access to authorized management networks only; firewall rules limiting connections to critical system subnets; network intrusion detection for anomalous access patterns; mandatory VPN tunnel access if remote management required; centralized logging with SIEM integration for forensic audit trails; contingency procedures for emergency device replacement or temporary service suspension if compromise is confirmed; regular access log review and threat monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Unifi Protect Ai Key
View allUnauthenticated attackers who can reach the Ubiquiti UniFi Protect AI Key over the network can abuse an improper access
Command injection in Ubiquiti's UniFi Protect AI Key lets a network-reachable, unauthenticated attacker (CVSS PR:N/UI:N)
Improper access control in the Ubiquiti UniFi Protect AI Key allows network-adjacent unauthenticated attackers to read l
Improper access control in Ubiquiti UniFi Protect AI Key allows remote unauthenticated attackers with network reachabili
Path traversal in UniFi Protect AI Key allows unauthenticated, network-reachable attackers to obtain limited information
A path traversal write/truncate primitive in Ubiquiti's UniFi Protect AI Key lets unauthenticated attackers who already
Exploit-DB