An improper access control vulnerability in Ubiquiti UniFi Connect Display Cast devices allows authenticated attackers to modify system settings, posing a significant risk to device integrity.

The flaw is an improper access control issue within the device API that permits an authenticated user to bypass intended restrictions and execute unsupported system changes. The vulnerability requires the attacker to possess valid, low-level credentials to interact with the API.

Successful exploitation allows an attacker to manipulate device configurations, which could lead to unauthorized system behavior, loss of availability, or potential pivoting into the internal network. With a CVSS score of 8.1, the vulnerability is classified as High, reflecting the potential for significant impact on device confidentiality and integrity despite the requirement for initial authentication.

Immediate Action: Update UniFi Connect Display Cast to version 1.10.7, Pro to 1.0.94, and Lite to 1.1.8 or later immediately to resolve the access control flaw.

Proactive Monitoring: Audit API access logs for anomalous behavior or unexpected modification requests originating from non-administrative user accounts.

Compensating Controls: Restrict access to the management API to trusted network segments and ensure that only authorized personnel have valid credentials to interact with the device interface.

Public Exploit Available: No

Organizations utilizing Ubiquiti UniFi Connect Display Cast devices must prioritize applying the provided firmware updates across all affected product lines. Given the potential for unauthorized configuration changes, timely patching is essential to maintain the security posture of the network display infrastructure.