The vulnerability arises from a series of authenticated SQL Injection flaws in Ubiquiti’s UniFi Talk Application. An attacker with network access and low‑privilege credentials can inject malicious SQL commands, allowing them to execute commands on the host’s database and elevate their privileges to those of the host device. This flaw is represented by CWE-89 and, if exploited, grants the attacker broad control over the device and potentially the surrounding network.

The flaw affects Ubiquiti Inc’s UniFi Talk Application. While the advisory does not list specific version exclusions, all installed instances may be vulnerable until a patch is applied. Administrators should treat every deployed copy as potentially impacted unless they confirm a fix has been installed.

The CVSS score of 9.9 places the issue in the Critical severity range. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits yet. The attack requires network connectivity and authenticated low‑privilege credentials, so the likely vector is a network‑based manipulation of the application’s SQL queries. The risk is higher in environments where the device is reachable from untrusted networks or where account hygiene is weak.