A critical command injection vulnerability in Ubiquiti UniFi Access Application, exploitable by low-privileged network users, poses a severe risk of full system compromise.

The application fails to properly validate input, which allows an attacker with low-level network access to execute arbitrary commands on the host operating system. This vulnerability requires the attacker to be authenticated with at least low-level privileges.

The ability to execute arbitrary commands on the host device grants an attacker full control over the UniFi Access system, potentially leading to unauthorized physical access control, data exfiltration, or complete service disruption. With a CVSS score of 9.9, this vulnerability represents an extreme risk to organizational security, as it facilitates lateral movement and total system takeover by malicious actors.

Immediate Action: Update the Ubiquiti UniFi Access Application to version 4.3.5 or later to resolve the underlying input validation flaw.

Proactive Monitoring: Monitor system logs for unusual command execution patterns and review UniFi Access administrative logs for unauthorized or suspicious activity by low-privileged user accounts.

Compensating Controls: Implement network segmentation to restrict access to the UniFi Access management interface to known, trusted management VLANs, thereby reducing the attack surface for low-privileged users.

Public Exploit Available: No (exploit_available: false)

Given the critical CVSS severity of 9.9, this vulnerability presents an immediate and substantial threat to infrastructure security. Administrators must prioritize the deployment of the 4.3.5 update across all affected UniFi Access instances to eliminate the possibility of command injection. Delaying this patch could allow adversaries with existing low-level network access to escalate their privileges to full system control.