This vulnerability (CVE-2026-22562) involves a path traversal flaw (CWE-22) in the firmware of Ubiquiti UniFi Play PowerAmp and UniFi Play Audio Port devices. Exploitation requires network access to the UniFi Play network and allows an attacker to write files arbitrarily on the device filesystem. Such file writes can be leveraged to achieve remote code execution. The issue affects firmware versions 1.0.35 and earlier for PowerAmp and 1.0.24 and earlier for Audio Port. Vendor-provided mitigation is to update to firmware versions 1.0.38+ and 1.1.9+ respectively. The vulnerability has a CVSS score of 9.8, reflecting its critical impact and ease of exploitation without privileges or user interaction.

Successful exploitation allows an unauthenticated attacker with network access to write arbitrary files on the affected devices, potentially leading to remote code execution. This can compromise device confidentiality, integrity, and availability, posing a critical risk to the UniFi Play network environment.

Ubiquiti has released firmware updates that address this vulnerability. Users should update UniFi Play PowerAmp devices to version 1.0.38 or later and UniFi Play Audio Port devices to version 1.1.9 or later. Applying these updates mitigates the vulnerability. No other mitigation guidance is provided or required by the vendor.