This vulnerability (CVE-2026-22563) involves improper input validation (CWE-20) in Ubiquiti Inc's UniFi Play PowerAmp and UniFi Play Audio Port products. It allows a remote attacker with network access to the affected devices to perform command injection, potentially leading to full compromise of the device. The affected versions are UniFi Play PowerAmp 1.0.35 and earlier, and UniFi Play Audio Port 1.0.24 and earlier. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has released fixed versions 1.0.38+ for PowerAmp and 1.1.9+ for Audio Port to address this issue.

An attacker with network access to the UniFi Play devices can exploit improper input validation to execute arbitrary commands on the device. This can lead to full compromise, including unauthorized control, data disclosure, and disruption of service. The critical CVSS score of 9.8 reflects the severity and ease of exploitation without privileges or user interaction.

Update affected devices to UniFi Play PowerAmp version 1.0.38 or later and UniFi Play Audio Port version 1.1.9 or later. These updates contain fixes that address the improper input validation and prevent command injection. No other mitigation guidance is provided or required beyond applying these official updates.