The vulnerability is an Improper Input Validation flaw in Ubiquiti's UID Enterprise Agent that allows an attacker with network access and low privileges to trigger command injection on the host. This can lead to unauthorized execution of arbitrary commands, potentially compromising confidentiality, integrity, and availability of the device. The weakness corresponds to CWE-20, reflecting insufficient validation of input before command execution.

Vendors: Ubiquiti Inc. Product: UID Enterprise Agent. No specific version information is provided, so all installations of this agent are potentially affected until an update is applied.

The CVSS score of 9.9 indicates a critical severity. EPSS is not available, so the current exploitation likelihood cannot be quantified. The vulnerability is not in the CISA KEV catalog, but its high severity and command‑execution capability suggest it could be a target for attackers in a compromised network. The likely attack vector is the network path that a low‑privileged user can reach from the device’s network segment, sending crafted inputs that trigger the flaw. Attackers would only need to send crafted packets or inputs over the network to accomplish the injection, requiring only low privileges on the device, which makes exploitation more feasible compared to requiring administrative access.