A malicious actor with network access can trigger an improper input validation flaw that results in command injection on the UniFi Protect AI Key device. The vulnerability permits an attacker to inject and execute arbitrary system commands, potentially leading to full remote compromise of the device, disruption of surveillance services, and further lateral movement within the local network.

Affected are Ubiquiti Inc’s UniFi Protect AI Key product. No specific firmware versions are disclosed, so all released versions of this device are considered vulnerable until a patch is applied.

The CVSS score of 8.1 places this flaw in the High severity category. An EPSS score of 1% indicates a very low but non-zero exploitation probability, and the vulnerability is not present in the CISA KEV catalog. Based on the description, the attack vector is likely local network access combined with the required configuration conditions, and successful exploitation would enable an attacker to run commands with the device’s system privileges.