This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Ubiquiti UniFi Play fixes 5 vulnerabilities
Ubiquiti fixes 5 vulnerabilities in UniFi Play PowerAmp and UniFi Play Audio Port. The most severe of them are described below; the rest can be found at [1]. Fixed versions of individual products: UniFi Play PowerAmp - 1.0.38 UniFi Play Audio Port - 1.1.9
An unauthenticated remote attacker can, under certain circumstances, write files to the system and thereby potentially execute code [1].
The vulnerability is present in products:
- UniFi Play PowerAmp; <=1.0.35;
- UniFi Play Audio Port; <=1.0.24;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-22562 at cve.org, NVD
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org
The vulnerability was publicly disclosed 7. 4. 2026.
An unauthenticated remote attacker can, under certain conditions, execute commands on the system [1].
The vulnerability is present in products:
- UniFi Play PowerAmp; <=1.0.35;
- UniFi Play Audio Port; <=1.0.24;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-22563 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 7. 4. 2026.
An unauthenticated remote attacker can, under certain conditions, enable the SSH protocol and subsequently make unauthorized changes to the system [1].
The vulnerability is present in products:
- UniFi Play PowerAmp; <=1.0.35;
- UniFi Play Audio Port; <=1.0.24;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-22564 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 7. 4. 2026.
By CESNET, z.s.p.o. Michaela Ručková on 4. 5. 2026.