A critical improper access control vulnerability in the Ubiquiti UniFi Connect Application allows unauthenticated network attackers to escalate privileges, posing a significant risk to system integrity.

The vulnerability stems from improper access control (CWE-284) within the application, which can be triggered by an unauthenticated network-adjacent attacker to escalate privileges.

The ability for an unauthenticated user to escalate privileges within the UniFi Connect Application represents a high risk to organizational security. Successful exploitation could lead to unauthorized administrative control over network management functions, potentially resulting in full system compromise or the disruption of critical network services. With a CVSS score of 8.2, this vulnerability is classified as high severity and requires immediate attention to prevent unauthorized access to management infrastructure.

Immediate Action: Upgrade the UniFi Connect Application to version 3.24.22 or later immediately to resolve the access control flaw.

Proactive Monitoring: Review system access logs for anomalous authentication patterns or unexpected administrative actions originating from unauthorized network segments.

Compensating Controls: Implement network segmentation to restrict access to the management interface of the UniFi Connect Application to trusted IP addresses only, thereby limiting the attack surface.

Public Exploit Available: No (Exploit_available: false)

Given the potential for privilege escalation and the high CVSS score, this vulnerability poses a substantial threat to the stability and security of the UniFi management environment. Security teams must prioritize updating the UniFi Connect Application to the fixed version 3.24.22 as soon as possible. Failure to remediate this vulnerability leaves the management interface exposed to potentially devastating unauthorized access.