UniFi Play Devices Face Critical Command Injection Vulnerabilities

The National Vulnerability Database (NVD) has issued a critical advisory regarding multiple improper input validation vulnerabilities, tracked as CVE-2026-22563. These flaws, affecting UniFi Play PowerAmp and UniFi Play Audio Port devices, could enable a malicious actor with network access to execute command injection attacks.

Specifically, the NVD reports that UniFi Play PowerAmp devices running version 1.0.35 and earlier, along with UniFi Play Audio Port devices on version 1.0.24 and earlier, are susceptible. This isn’t just a bump in the road; with a CVSS score of 9.8, this vulnerability is sitting squarely in the ‘critical’ zone. Improper input validation (CWE-20) is often a gateway to more severe issues, and in this case, it’s a direct path to full-blown command injection.

The implications are significant. A successful command injection could grant an attacker extensive control over the affected devices, leading to data compromise, system disruption, or even lateral movement within a compromised network. It’s the kind of access that keeps security pros up at night. Fortunately, mitigations are available.