The vulnerability is a Path Traversal flaw (CWE-22) that allows a malicious actor with network reach to supply a crafted file path to a UniFi OS device, causing the device to bypass its normal authentication checks. The result is unauthorized access to the device’s management interface and any functions exposed there, effectively granting administrative control.

The flaw impacts Ubiquiti Inc. products, including Cloud Gateways, Cloud Keys, Dream Machines, Dream Routers, Dream Wall, Enterprise Firewall Core, Enterprise Fortress Gateway, Enterprise Video Recorders, Express 7, Network Attached Storage, Network Video Recorders, and UniFi OS Server. Specific affected firmware revisions are not listed in the advisory, so users should verify that their device version is either the patched release or has the path‑traversal fix applied.

This vulnerability carries a CVSS base score of 8.6, indicating high severity. The EPSS score is below 1 %, and it is not included in the CISA KEV catalog, implying it is infrequently targeted. Based on the description, it is inferred that the attack vector requires network access to the UniFi OS device’s management interface; an attacker must be able to reach the device’s API or web interface to exploit the path‑traversal and bypass authentication, gaining full administrative control without valid credentials.