The vulnerability is a flaw in the discovery protocol of the UniFi Protect Application version 6.1.79 and earlier. An attacker who can reach the camera on the same or adjacent local network can send crafted discovery packets that bypass authentication, allowing the attacker to view camera streams or gain control of the camera device. This represents an authentication bypass weakness (CWE-287).

Ubiquiti Inc's UniFi Protect Application, v6.1.79 or earlier.

A CVSS score of 8.8 indicates high severity, while an EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to be on the camera’s local network vicinity. Once reached, the attacker can access the camera’s services without proper credentials, enabling privacy or operational compromise. The lack of external remote access conditions reduces the likelihood of widespread infection but still poses a serious risk to networks that allow local discovery traffic.