UniFi Connect Application has an Improper Access Control flaw (CWE‑284) that allows an attacker who can reach the application over the network to inject arbitrary shell commands. This gives host‑level code execution capability, enabling the attacker to exfiltrate data, modify configuration, or establish persistence without user interaction.

All deployments of Ubiquiti Inc’s UniFi Connect Application may be affected. No specific product versions are listed, so any instance could be vulnerable until the vendor releases a patch.

The CVSS score of 10 indicates maximum severity, while the EPSS score of 3% suggests a moderate probability of exploitation. Based on the description, the likely attack vector is network connectivity to the UniFi Connect service with no authentication requirement, making the vulnerability highly exploitable in environments that expose the service. The vulnerability is not listed in CISA KEV, but its high severity warrants immediate remediation.