Unifi Protect Ai Key
Monthly
Unauthenticated attackers who can reach the Ubiquiti UniFi Protect AI Key over the network can abuse an improper access control weakness to read information from the device, make unauthorized changes, and knock it offline. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, base 8.6) confirms the attack requires no credentials and no user interaction, with the dominant impact being a high-availability Denial of Service and limited confidentiality and integrity effects. No public exploit code was identified and there is no CISA KEV listing at time of analysis; Ubiquiti's Security Advisory Bulletin 070 is the authoritative source for affected firmware and fixes.
Command injection in Ubiquiti's UniFi Protect AI Key lets a network-reachable, unauthenticated attacker (CVSS PR:N/UI:N) potentially execute arbitrary operating-system commands on the appliance, giving full loss of confidentiality, integrity, and availability. Per the supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), exploitation is high-complexity: the vendor conditions success on unspecified preconditions ('under certain conditions'), so attacks are not expected to succeed against every deployment and require the attacker to reach the device's network and satisfy environment-specific state. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was provided; the practical exposure is dominated by whether the AI Key is reachable from untrusted network segments.
Privilege escalation in Ubiquiti's UniFi Protect AI Key lets a network-adjacent attacker abuse an improper access control (authentication-bypass) weakness to gain elevated privileges on the device, per Ubiquiti's own advisory (Security Advisory Bulletin 067). The CVSS 9.8 rating reflects a network-reachable, no-authentication, no-interaction path yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
A path traversal write/truncate primitive in Ubiquiti's UniFi Protect AI Key lets unauthenticated attackers who already have network reachability to the device create or truncate files on it when specific, attacker-uncontrolled conditions are met. Impact is limited to integrity (CVSS 3.1 score of 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) - no code execution, data disclosure, or availability loss is claimed - and the high attack complexity points to a required precondition such as a race condition or a particular device state. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); Ubiquiti's Security Advisory Bulletin 070 is the authoritative reference.
Path traversal in UniFi Protect AI Key allows unauthenticated, network-reachable attackers to obtain limited information about files on the device, but exploitation requires high attack complexity and specific conditions per the vendor. No public exploit code or active exploitation has been identified at time of analysis. The CVSS score is 3.7 (Low), reflecting the difficulty of exploitation and the restricted confidentiality impact.
Improper access control in the Ubiquiti UniFi Protect AI Key allows network-adjacent unauthenticated attackers to read limited internal resources, though exploitation hinges on high attack complexity and an unspecified conditional requirement that limits real-world reliability. This medium-severity (CVSS 5.3) flaw is not known to be actively exploited and no public exploit code exists as of analysis. The vendor has published Security Advisory Bulletin 070 with remediation guidance.
Improper access control in Ubiquiti UniFi Protect AI Key allows remote unauthenticated attackers with network reachability to access internal resources through the device. The CPE wildcard indicates all versions may be affected, and the vendor-assigned CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), with low confidentiality impact only. No public exploit code has been identified at time of analysis, and exploitation is constrained by the need for network access to a reachable device.
Unauthenticated attackers who can reach the Ubiquiti UniFi Protect AI Key over the network can abuse an improper access control weakness to read information from the device, make unauthorized changes, and knock it offline. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, base 8.6) confirms the attack requires no credentials and no user interaction, with the dominant impact being a high-availability Denial of Service and limited confidentiality and integrity effects. No public exploit code was identified and there is no CISA KEV listing at time of analysis; Ubiquiti's Security Advisory Bulletin 070 is the authoritative source for affected firmware and fixes.
Command injection in Ubiquiti's UniFi Protect AI Key lets a network-reachable, unauthenticated attacker (CVSS PR:N/UI:N) potentially execute arbitrary operating-system commands on the appliance, giving full loss of confidentiality, integrity, and availability. Per the supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), exploitation is high-complexity: the vendor conditions success on unspecified preconditions ('under certain conditions'), so attacks are not expected to succeed against every deployment and require the attacker to reach the device's network and satisfy environment-specific state. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was provided; the practical exposure is dominated by whether the AI Key is reachable from untrusted network segments.
Privilege escalation in Ubiquiti's UniFi Protect AI Key lets a network-adjacent attacker abuse an improper access control (authentication-bypass) weakness to gain elevated privileges on the device, per Ubiquiti's own advisory (Security Advisory Bulletin 067). The CVSS 9.8 rating reflects a network-reachable, no-authentication, no-interaction path yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
A path traversal write/truncate primitive in Ubiquiti's UniFi Protect AI Key lets unauthenticated attackers who already have network reachability to the device create or truncate files on it when specific, attacker-uncontrolled conditions are met. Impact is limited to integrity (CVSS 3.1 score of 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) - no code execution, data disclosure, or availability loss is claimed - and the high attack complexity points to a required precondition such as a race condition or a particular device state. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); Ubiquiti's Security Advisory Bulletin 070 is the authoritative reference.
Path traversal in UniFi Protect AI Key allows unauthenticated, network-reachable attackers to obtain limited information about files on the device, but exploitation requires high attack complexity and specific conditions per the vendor. No public exploit code or active exploitation has been identified at time of analysis. The CVSS score is 3.7 (Low), reflecting the difficulty of exploitation and the restricted confidentiality impact.
Improper access control in the Ubiquiti UniFi Protect AI Key allows network-adjacent unauthenticated attackers to read limited internal resources, though exploitation hinges on high attack complexity and an unspecified conditional requirement that limits real-world reliability. This medium-severity (CVSS 5.3) flaw is not known to be actively exploited and no public exploit code exists as of analysis. The vendor has published Security Advisory Bulletin 070 with remediation guidance.
Improper access control in Ubiquiti UniFi Protect AI Key allows remote unauthenticated attackers with network reachability to access internal resources through the device. The CPE wildcard indicates all versions may be affected, and the vendor-assigned CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), with low confidentiality impact only. No public exploit code has been identified at time of analysis, and exploitation is constrained by the need for network access to a reachable device.