UniFi OS devices contain a path traversal flaw (CWE‑22) that permits a network‑connected attacker to read or modify arbitrary files on the host operating system. The official description does not specify whether authentication is required, so it can be inferred that the flaw may be exploitable by anyone who can reach the device’s management interface. By manipulating these files, an adversary could gain control of a privileged system account, effectively taking full control of the device and its services.

All Ubiquiti UniFi OS products listed by the CNAs – routers, switches, access points, UDM family, UNAS, UNVR, UCG, and the UniFi OS Server – are potentially affected. No specific firmware versions are indicated in the CVE data.

The CVSS score of 10 this flaw as critical, and the EPSS score of 65% indicates a high likelihood that exploitation is being attempted in the wild. The vulnerability is listed in CISA’s KEV catalog, confirming that attacks have already occurred. The attack vector is most likely exploitation from the local network through the device’s management interface. Successful exploitation can lead to compromise of system accounts, device takeover, and potential pivoting within the network or deployment of malware. Security teams should treat this as a top‑priority risk until a vendor‑issued fix is available.