A critical input validation flaw in the Ubiquiti UniFi Access Application allows authenticated low-privileged attackers to perform command injection, leading to host system compromise.

This vulnerability arises from insufficient input validation within the application's processing logic. An attacker with low-privileged network access can inject malicious commands, which are then executed by the host system with elevated privileges.

The CVSS score of 9.9 highlights the extreme danger posed by this vulnerability. Successful exploitation grants attackers the ability to execute unauthorized commands, potentially resulting in full system takeover, unauthorized access to physical security controls managed by the application, and significant operational disruption.

Immediate Action: Update the Ubiquiti UniFi Access Application to the latest version immediately to ensure input validation is correctly implemented.

Proactive Monitoring: Review system audit logs for unauthorized command execution and audit all user accounts for suspicious activities or unexpected privilege changes.

Compensating Controls: Utilize network-level controls to restrict access to the application interface to trusted internal segments, thereby mitigating the risk of exploitation by unauthorized actors.

Public Exploit Available: No

Given the critical severity of this vulnerability, administrators must act promptly to apply the necessary patches. Securing the UniFi Access Application is vital, as this component often manages sensitive physical security parameters; therefore, timely remediation is essential to maintain the integrity of the overall security posture.