Executive brief
UniFi Enterprise Audio/Video Bridge is a network device used to manage audio and video communication streams in enterprise environments. An attacker with network access can exploit an input validation flaw to inject and execute arbitrary commands on the device, potentially compromising the system's integrity and availability, and gaining unauthorized control over critical communication infrastructure.
Technical details
The vulnerability is a command injection issue stemming from improper input validation in UniFi Enterprise Audio/Video Bridge. An attacker with network access (no authentication required based on the CVSS 9.8 network vector) can send specially crafted input to exploit this weakness and execute arbitrary commands on the device with the privileges of the affected service. This could allow full system compromise, data exfiltration, or lateral movement within the network. Patch availability should be verified through Ubiquiti's security advisory.
Affected products
- Ubiquiti UniFi Enterprise Audio/Video Bridge
Timeline
- 2026-08-26: disclosed