A flaw in the management interfaces of certain Ubiquiti UniFi OS devices allows an attacker who can reach the local network to alter device settings without proper authorization. The vulnerability is classified as a NVD-CWE-Other improper access control issue, meaning the system fails to enforce correct permissions on configuration endpoints. Unauthorized changes could enable the attacker to reconfigure network routing, firewall rules, or device identifiers, compromising device integrity and potentially exposing the broader network.

Devices affected include Ubiquiti Inc Cloud Gateways, Dream Machines, Dream Routers, Dream Wall, Enterprise Firewall Core, Enterprise Fortress Gateway, and Express 7. The issue applies to certain models running UniFi OS, but specific firmware versions are not listed in the advisory, so the exact scope of affected firmware remains uncertain beyond the aforementioned devices.

The CVSS score of 9 indicates high severity. The EPSS score is less than 1%, reflecting a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers would need local network access that allows management traffic to reach the UniFi OS device; this is inferred from the advisory wording that a malicious actor with network access can exploit it under specific device configurations.