A critical command injection vulnerability in Ubiquiti UniFi Enterprise Audio/Video Bridge allows unauthenticated attackers to execute arbitrary code with device-level privileges.

The device suffers from improper input validation that permits command injection. An unauthenticated attacker with network access can inject arbitrary commands, leading to full system compromise.

Successful exploitation of this vulnerability allows an attacker to achieve full control over the affected hardware, potentially leading to unauthorized data access, network lateral movement, or complete loss of service. Given the CVSS score of 9.8, this flaw represents an extreme risk to network integrity and security.

Immediate Action: Update the Ubiquiti UniFi Enterprise Audio/Video Bridge firmware to version 1.0.11 or later immediately.

Proactive Monitoring: Review network access logs for suspicious traffic patterns directed at the device, especially those involving unexpected shell commands or encoded payloads.

Compensating Controls: Isolate the affected devices on a restricted management VLAN and implement strict firewall rules to prevent unauthorized network access to the device management interface.

Public Exploit Available: No

This is a critical vulnerability that demands immediate attention. Organizations must prioritize applying the 1.0.11 firmware update across all affected UniFi Enterprise Audio/Video Bridge units to prevent potential remote code execution by malicious actors.