The flaw is a path traversal in UniFi Protect AI Key that permits a malicious actor with network access to create or truncate files on the device, potentially compromising the integrity of the device’s file system and enabling the placement of malicious code or configuration changes. It does not provide remote code execution or privilege escalation beyond the file manipulation capability. This weakness is classified as CWE‑22.

The vulnerability affects all UniFi Protect AI Key devices manufactured by Ubiquiti Inc. No specific firmware versions are reported, so any device running current or legacy firmware should be considered at risk until a vendor‑supplied fix is applied.

The CVSS score of 3.7 indicates a low severity level, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog. Based on the advisory text, it is inferred that the attack requires local or near‑network access and the ability to send crafted requests that trigger the path traversal; there is no evidence of remote code execution or elevation of privileges.