A series of improper input validation vulnerabilities in Ubiquiti Inc’s UniFi Play devices allow a malicious actor to perform command injection. This flaw can lead to remote code execution, compromising the device and potentially the entire network. The weakness is categorized as CWE‑20, indicating unsafe handling of external input.

Affected products are the UniFi Play PowerAmp running version 1.0.35 or earlier, and the UniFi Play Audio Port running version 1.0.24 or earlier. These devices are used to manage audio output and power amplification in networked environments.

The vulnerability carries a CVSS score of 9.8, indicating a severe impact if exploited. The EPSS score is unavailable and the vulnerability is not listed in CISA's KEV catalog, but the high severity suggests that it may be actively targeted. Based on the description, the likely attack vector is an actor with access to the UniFi Play network, implying that an internal attacker or someone who has compromised a downstream device could exploit the flaw. Successful exploitation would grant privileged control over the underlying operating system, enabling lateral movement, privilege escalation, and potential compromise of the connected network.