The vulnerability is an Improper Input Validation flaw (CWE‑20) in UniFi OS that allows an actor with network access and low privileges to send malformed input and gain higher privileges on the device. The CVE description does not state any further capabilities beyond privilege escalation, but an attacker who has recovered elevated rights would be able to modify device configuration or otherwise hijack the device.

The flaw affects any Ubiquiti Inc product that runs UniFi OS, including the EFG, ENVR, Express, UCG‑Fiber, UCG‑Industrial, UCK, UDM, UDR, UDW, UNAS‑2, UNAS‑4, UNAS‑Pro, UNVR, UNVR‑G2, UNVR‑Instant, and the UniFi OS Server. Specific firmware versions are not enumerated in the advisory; all devices that are intended to run the vulnerable UniFi OS release should be viewed as at risk.

The high CVSS score of 9.9 indicates critical severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires only network proximity and low privileges, the barrier to exploitation is low; any user who can reach the device on the network and has minimal privileges could exploit the flaw. This the likely vector for exploitation, as inferred from the description of network access being required.