An improper access control flaw (CWE-284) in UniFi OS devices allows an attacker with network reach to alter system configuration. The vulnerability permits modification of device settings that govern network operation, compromising device integrity and potentially affecting the services it supports.

All UniFi OS devices listed by the CNA, including EFG, ENVR, ENVR‑Core, Express 7, UCG‑Fiber, UCG‑Industrial, UCG‑Max, UCG‑Ultra, UCK, UCK‑Enterprise, UCKP, UDM, UDM‑Beast, UDM‑Pro, UDM‑Pro‑Max, UDM‑SE, UDR, UDR‑5G, UDR7, UDW, UNAS‑2, UNAS‑4, UNAS‑Pro, UNAS‑Pro‑4, UNAS‑Pro‑8, UNVR, UNVR‑G2, UNVR‑G2‑Pro, UNVR‑Instant, UNVR‑Pro, and UniFi OS Server. No specific firmware or software version information is provided, so every deployment of these devices should be treated as vulnerable.

The vulnerability has a CVSS score of 10, indicating the highest severity. The EPSS score is 15% and the issue is listed in the CISA KEV catalog, indicating that exploit code or active attacks are known. The likely attack vector is network access to the affected UniFi OS devices; no additional credentials or privileged access are required.