CVE-2026-22562 — UniFi Play PowerAmp Path Traversal RCE (CVSS 9.8)

Executive Summary

CVE-2026-22562 is a critical path traversal vulnerability (CWE-22) in the firmware of UniFi Play PowerAmp and UniFi Play Audio Port devices. A malicious actor with access to the UniFi Play network can exploit this flaw to write arbitrary files to the device filesystem, enabling unauthenticated remote code execution with no privileges required.

CVSS Score: 9.8 (Critical) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This vulnerability was disclosed as part of Ubiquiti Security Advisory Bulletin 063 on April 13, 2026, alongside three related issues (CVE-2026-22563, CVE-2026-22564, CVE-2026-22566) affecting the same product family. All affected devices should be updated immediately.

Vulnerability Overview

Affected Products

Related Vulnerabilities (Same Advisory)

Ubiquiti Security Advisory Bulletin 063 disclosed four CVEs affecting the UniFi Play product family:

The combination of CVE-2026-22562 and CVE-2026-22563 gives an unauthenticated attacker full device compromise capability.

Technical Analysis

Root Cause

The vulnerability exists in the firmware's file handling routines. Attacker-controlled input is used to construct file paths without adequate sanitization or normalization. By supplying path traversal sequences (e.g., ../../../), an attacker on the UniFi Play network can escape the intended directory context and write files to arbitrary locations on the device filesystem.

Attack Chain

Once arbitrary file write is achieved, several paths to remote code execution are available:

1. Startup script injection — Write a malicious script to an auto-executed location (init.d, cron, rc.local)
2. Binary replacement — Overwrite a system binary or service executable with a malicious version
3. Configuration tampering — Modify device configuration files to alter service behavior or enable backdoor access

Because the device runs firmware on embedded hardware, file writes that survive a reboot can achieve persistent compromise.

Network Requirement

Exploitation requires the attacker to have network access to the UniFi Play network segment where the device is deployed. This is typically a local Wi-Fi or LAN segment, not the wider internet — however, in improperly segmented networks (e.g., flat IoT networks, shared office networks, or networks with a compromised device already present), this access level is commonly achievable.

Exploitation Status

No public proof-of-concept exploit code had been released at the time of this advisory. The CVSS score and access requirements suggest moderate exploitation difficulty, though the lack of authentication requirements makes the vulnerability highly attractive for opportunistic attackers once a PoC becomes available.

Impact Assessment

Remediation

Immediate: Update Firmware

Apply the fixed firmware versions via the UniFi controller or UniFi mobile app:

# Verify installed firmware version via UniFi Network Application
# Navigate to: Devices → [Device Name] → Settings → Firmware
 
# Alternatively, check from SSH (if enabled):
cat /etc/board.info | grep -i version

Network Segmentation

Isolate IoT/audio devices from general corporate or guest networks:

Recommended network topology:
  ├── Corporate LAN (VLAN 10) — workstations, servers
  ├── IoT/AV Network (VLAN 20) — UniFi Play, AV equipment
  │   └── Blocked: IoT → Corporate LAN
  │   └── Blocked: IoT → Internet (unless required)
  └── Guest Network (VLAN 30) — visitor Wi-Fi
      └── Blocked: Guest → IoT, Guest → Corporate

Proper VLAN segmentation means that even if a device is compromised, the blast radius is limited to the IoT segment.

Disable Unused Services

If SSH access is enabled on affected devices, disable it until the firmware is updated (relevant to CVE-2026-22564 in the same advisory):

# Check if SSH is enabled on the device
# Via UniFi Network Application: Devices → [Device] → Settings → Advanced → SSH

Detection

Monitor for signs of exploitation or post-compromise activity:

# Check for unexpected network connections from UniFi Play devices
# Monitor via Wireshark, pfSense firewall logs, or UniFi network insights
 
# UniFi Network Application: Insights → Client → Filter by UniFi Play devices
# Look for: unexpected destinations, large data transfers, non-standard ports

References

• NVD — CVE-2026-22562
• Ubiquiti Security Advisory Bulletin 063
• Related — CVE-2026-22563 (Command Injection, CVSS 9.8)