A vulnerability in certain Ubiquiti UniFi OS devices allows an attacker who can reach management traffic over the local network, when specific network configurations exist, to change device settings without authorization. The flaw is identified as a CWE‑284 improper access control issue, meaning the system does not correctly enforce permissions on configuration endpoints.

Devices affected include Ubiquiti Inc Cloud Gateways, Dream Machines, Dream Routers, Dream Wall, Enterprise Firewall Core, Enterprise Fortress Gateway, and Express 7. The vulnerability applies to certain models running UniFi OS, but specific firmware versions are not listed in the advisory, so the scope remains uncertain beyond the aforementioned devices.

The CVSS score of 9 indicates high severity. The EPSS score is less than 1%, reflecting a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers would need local network access that allows management traffic to reach the UniFi OS device; this is inferred from the advisory wording that a malicious actor with network access can exploit it under specific device configurations.