Executive brief
A vulnerability in Ubiquiti UniFi Play audio devices could allow an attacker on the same network to crash the hardware. These devices are used for professional audio distribution and amplification in commercial or residential settings. An exploit would result in a complete loss of audio services, requiring a manual restart or firmware update to restore operations.
Technical details
An improper input validation vulnerability (CWE-20) exists in the firmware of UniFi Play PowerAmp and Audio Port devices. A remote attacker with network access to the UniFi Play environment can send specially crafted input to the device, causing it to stop responding or crash. This is a denial-of-service (DoS) vulnerability that affects availability but does not appear to impact data confidentiality or integrity. The issue is resolved in UniFi Play PowerAmp version 1.0.38 and UniFi Play Audio Port version 1.1.9.
Affected products
- Ubiquiti UniFi Play PowerAmp 1.0.35 and earlier
- Ubiquiti UniFi Play Audio Port 1.0.24 and earlier
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory