The vulnerability is an Improper Access Control flaw found in the firmware of the UniFi Protect AI Key. An attacker who can reach the device over the network and satisfies the conditions described by the vendor could bypass normal authorization checks to access internal resources that the device is permitted to reach. This flaw allows the attacker to read or manipulate data and services that are not intended for public or unauthorised access, but it does not provide remote code execution or denial of service capabilities.

The affected product is the Ubiquiti UniFi Protect AI Key. No specific firmware or device versions are provided in the advisory, so any installation of this product that has not applied the vendor’s latest update may be vulnerable.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% indicates a very low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to have network connectivity to the device and to exploit the improper access control after certain conditions are met, as described in the advisory. Successful exploitation would grant the attacker unauthorized access to internal resources reachable through the device.