This vulnerability involves multiple authenticated SQL Injection issues in the UniFi Talk Application by Ubiquiti Inc. An attacker with low privilege network access can leverage these flaws to escalate privileges on the host device, potentially gaining full control. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, no user interaction, and complete compromise of confidentiality, integrity, and availability. The vulnerability is confirmed published but lacks vendor remediation details or patch information at this time.

Successful exploitation allows an attacker with low privileges and network access to perform SQL Injection attacks that escalate their privileges on the host device. This can lead to full compromise of the device, including unauthorized data access, modification, or denial of service. The critical CVSS score indicates a severe security risk to affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the UniFi Talk Application and limit privileges of users to reduce exposure. Monitor vendor communications for updates on patches or official mitigations.