This vulnerability (CVE-2026-22563) is classified as CWE-20 (Improper Input Validation) and affects Ubiquiti Inc's UniFi Play PowerAmp and UniFi Play Audio Port devices. It allows command injection by a malicious actor who has network access to the affected devices. The vulnerability is present in UniFi Play PowerAmp versions up to 1.0.35 and UniFi Play Audio Port versions up to 1.0.24. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. The vendor has provided patched versions (1.0.38+ for PowerAmp and 1.1.9+ for Audio Port) to remediate this issue.

Successful exploitation of this vulnerability could allow an unauthenticated attacker with network access to execute arbitrary commands on the affected devices. This can lead to full compromise of device confidentiality, integrity, and availability, potentially disrupting device operation and exposing sensitive information.

A fix is available. Users should update UniFi Play PowerAmp to version 1.0.38 or later and UniFi Play Audio Port to version 1.1.9 or later to remediate this vulnerability. Applying these updates will mitigate the risk of command injection attacks exploiting this issue.