Executive brief
Ubiquiti UniFi Play audio devices, including the PowerAmp and Audio Port, are affected by a security flaw that allows unauthorized users on the network to enable remote management (SSH). Once enabled, an attacker can gain full control over the device to modify settings or disrupt audio services. This could lead to unauthorized access to the local network or permanent tampering with the hardware.
Technical details
An improper access control vulnerability (CWE-284) exists in the UniFi Play network protocol used by PowerAmp and Audio Port devices. A remote, unauthenticated attacker with network access to the device can exploit this flaw to enable the SSH service without authorization. Successful exploitation grants the attacker the ability to log into the device's operating system, leading to full system compromise, unauthorized configuration changes, and potential persistence. The vulnerability is addressed in UniFi Play PowerAmp version 1.0.38 and UniFi Play Audio Port version 1.1.9.
Affected products
- Ubiquiti UniFi Play PowerAmp 1.0.35 and earlier
- Ubiquiti UniFi Play Audio Port 1.0.24 and earlier
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory