The vulnerability is an Improper Access Control flaw in UniFi Connect Display Cast Pro that allows a malicious actor with network access, under certain conditions, to gain elevated privileges on the device. Because the attacker can override standard permission checks, they could control the device, potentially compromising device configuration, accessing sensitive data transmitted through the device, or opening the device to further lateral movement. The flaw is reflected in CWE-284, highlighting the failure of adequate access control enforcement.

The affected product is Ubiquiti Inc's UniFi Connect Display Cast Pro. Version information is not specified in the advisory, so all deployments of this product remain a potential risk until a patch is applied or further details are published.

The CVSS score of 9 indicates a high severity, and the EPSS score is not available, leaving the exploitation probability unknown. The vulnerability is not listed in CISA's KEV catalog, suggesting no confirmed exploits yet. Because the description specifies that the attacker must have network access, the most likely attack vector is a remote network-based exploitation. No other prerequisites beyond network connectivity are mentioned, implying that once the device is reachable on the network, an attacker could craft the exploit payload to elevate privileges.