A critical command injection vulnerability in the UniFi Connect EV Station Lite allows remote, unauthenticated attackers to execute arbitrary code on the device.

This vulnerability stems from improper input validation, enabling an attacker to perform command injection, which can lead to full system compromise.

The CVSS score of 9.8 reflects the severity of this vulnerability, as it allows for complete system takeover. An attacker who gains control of the EV station could potentially use the device as a pivot point for further attacks on the internal network, leading to broader data compromise.

Immediate Action: Apply the latest firmware update for the UniFi Connect EV Station Lite as specified by the vendor.

Proactive Monitoring: Monitor network traffic for unusual patterns or command-line activity originating from the EV charging station management interface.

Compensating Controls: Use a firewall or network access control list (ACL) to restrict access to the device management interface to authorized administrative IP addresses only.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates immediate patching of all affected UniFi Connect EV Station Lite devices. Network administrators should verify that these devices are not directly exposed to the public internet and limit administrative access to prevent potential exploitation.