An Active Debug Code flaw in UniFi OS allows an attacker with network access and low privileges to elevate their rights on affected devices or instances. The vulnerability can be triggered under certain conditions, enabling the attacker to gain full control of configuration, network traffic, and potentially deploy further compromise tools. The flaw is a classic example of improper handling of debug services, which is cataloged as CWE-489.

Affected devices include Ubiquiti Cloud Gateways, Cloud Keys, Dream Machines, Dream Routers, Dream Wall, Enterprise Firewall Core, Enterprise Fortress Gateway, Enterprise Network Attached Storage, Enterprise Network Video Recorders, Express 7, Network Attached Storage, Network Video Recorders, and the UniFi OS Server. Specific version information was not disclosed in the advisory.

The CVSS score of 9 indicates a critical severity, and the EPSS score is not available, suggesting limited public exploitation data at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local network scenario where an actor with low privileges can manipulate debug code, thus raising their privileges within the device.