The vulnerability is an improper access control flaw that allows a malicious actor with network access to elevate privileges within the UniFi Connect Application. By gaining higher privileges, an attacker could alter application settings, configure network devices, and potentially bypass other security controls, thereby compromising the confidentiality, integrity, and availability of the managed network. The weakness maps to CWE-284, indicating a failure to enforce adequate access restrictions.

Affected systems are devices running Ubiquiti’s UniFi Connect Application. No specific version details are provided, so all current releases are likely vulnerable until a patch is applied.

The CVSS score of 8.2 signals a high severity risk, and while the EPSS score is not available, the lack of listing in CISA’s KEV catalog suggests no publicly available exploits are known yet. The likely attack vector is a network-based attacker who can reach the application’s ports; successful exploitation requires network proximity and the ability to authenticate locally or via default credentials. If exploited, the attacker could effectively operate with privileged application-level access.