A critical command injection vulnerability in Ubiquiti UniFi Access Application allows low-privileged attackers to gain full control over the host device.

This flaw is caused by improper input validation, which enables a low-privileged authenticated user to execute arbitrary commands on the underlying host operating system.

The ability for a low-privileged user to execute arbitrary commands poses a severe threat to organizational security, potentially leading to full system compromise, lateral movement within the network, and the exfiltration of sensitive access control data. Given the CVSS score of 9.9, this vulnerability represents an extreme risk to the availability and integrity of physical security infrastructure.

Immediate Action: Update the Ubiquiti UniFi Access Application to version 4.3.5 or later immediately to eliminate the vulnerable code path.

Proactive Monitoring: Review system and application logs for unusual command execution patterns or unexpected shell activity originating from the UniFi Access service account.

Compensating Controls: Restrict network access to the UniFi Access management interface to known, trusted administrative segments to prevent unauthorized low-privileged access.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability, combined with the potential for total host compromise, necessitates an immediate update to the latest patched version. Security administrators should prioritize this deployment to prevent potential exploitation of the management interface.