A flaw in UniFi OS devices allows a malicious actor who can access the local network and has high privileges to send specially crafted input to the system. The improper validation of that input enables the attacker to inject arbitrary operating‑system commands, resulting in the execution of any command with the service’s elevated privileges. The consequence is full compromise of the affected device and potential lateral movement across the network.

The vulnerability is present in Ubiquiti Inc. UniFi OS Servers. No specific firmware or software version information is disclosed, so all UniFi OS Server instances that have not applied a vendor fix are potentially affected.

The CVSS score of 9.1 indicates critical severity. The EPSS score is not available, but the lack of a KEV listing does not diminish the urgency. The flaw requires the attacker to be on the same network segment and possess high‑privilege credentials, which are common in typical deployment scenarios. If the attacker can achieve that foothold, command injection can be executed, leading to full system compromise and potential spread to other network assets.