An improper input validation flaw in Ubiquiti UniFi Play devices allows an attacker with access to the UniFi Play network to send specially crafted data that causes the device to stop responding, resulting in a loss of service and interruption of normal operation. The weakness is identified as input validation failure (CWE-20).

Affected products are Ubiquiti UniFi Play PowerAmp versions 1.0.35 and earlier, and Ubiquiti UniFi Play Audio Port versions 1.0.24 and earlier.

The vulnerability is susceptible to exploitation by anyone who can communicate with the device over the local UniFi Play network. Once triggered, the device experiences a disruption of service but no compromise of data or credentials is expected. Severity is moderate, with a denial-of-service impact. Exploit probability is unknown due to the lack of an EPSS score, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is local network access within the UniFi Play environment, inferred from the requirement that the attacker have network access to the device.