CVE-2026-110457 Overview
CVE-2026-110457 is a path traversal vulnerability [CWE-22] affecting Ubiquiti UniFi Protect AI Key. A network-based attacker can exploit the flaw under specific conditions to read file information on the device. The issue stems from improper sanitization of user-supplied path input, allowing directory traversal sequences to escape the intended working directory.
Ubiquiti disclosed the issue through Security Advisory Bulletin 070. The vulnerability does not require authentication, but exploitation requires meeting non-trivial conditions, which limits practical impact. No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Critical Impact
A remote attacker can enumerate file metadata on the UniFi Protect AI Key device, exposing information that may support further reconnaissance.
Affected Products
- Ubiquiti UniFi Protect AI Key (refer to Ubiquiti Security Advisory Bulletin 070 for version details)
Discovery Timeline
- 2026-10-14 - CVE-2026-110457 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-110457
Vulnerability Analysis
The vulnerability resides in a request handler within the UniFi Protect AI Key firmware that accepts a file or path parameter from a network client. The handler fails to normalize or validate the supplied path before performing a filesystem operation. An attacker can submit traversal sequences such as ../ to reference locations outside the intended directory.
The condition C:L/I:N/A:N in the vector indicates the impact is limited to disclosure of file information. The attacker cannot modify data or disrupt service through this flaw alone. The high attack complexity reflects conditions outside the attacker's control that must be satisfied for exploitation to succeed.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The affected code trusts input-derived path segments without canonicalization or allow-list validation. Resolution of the final path occurs after traversal sequences are already incorporated into the filesystem lookup.
Attack Vector
An unauthenticated attacker with network access to the UniFi Protect AI Key device sends a crafted request containing directory traversal sequences. If the preconditions required by the vulnerable code path are satisfied, the device returns information about files outside the expected directory scope. Exposure of configuration files, logs, or stored credentials could inform follow-on attacks.
No verified exploit code is available. See Ubiquiti Security Advisory Bulletin 070 for vendor-provided technical details.
Detection Methods for CVE-2026-110457
Indicators of Compromise
- HTTP or API requests to UniFi Protect AI Key endpoints containing ../, ..%2f, or encoded traversal patterns in path or query parameters.
- Access log entries referencing filesystem locations outside the application's expected working directory.
- Unexpected responses from the device returning file metadata, directory listings, or error strings disclosing absolute paths.
Detection Strategies
- Inspect network traffic to the management interface for directory traversal payloads using IDS or web application firewall signatures.
- Correlate device logs for repeated malformed path requests originating from a single source address.
- Baseline normal API call patterns on UniFi infrastructure and alert on deviations involving path parameters.
Monitoring Recommendations
- Forward UniFi Protect AI Key logs to a centralized log platform for retention and analysis.
- Monitor for anonymous network scans targeting Ubiquiti management ports on segments that host UniFi devices.
- Review authentication-adjacent telemetry for reconnaissance activity preceding exploitation attempts.
How to Mitigate CVE-2026-110457
Immediate Actions Required
- Apply the firmware update referenced in Ubiquiti Security Advisory Bulletin 070 as soon as the vendor-provided fix is available for your deployment.
- Restrict network reachability of UniFi Protect AI Key management interfaces to trusted administrative subnets.
- Audit device access logs for traversal patterns observed before the patch window.
Patch Information
Ubiquiti published fix guidance in Security Advisory Bulletin 070. Administrators should consult the advisory for the specific firmware version that remediates CVE-2026-110457 on their UniFi Protect AI Key model and update devices through the UniFi management workflow.
Workarounds
- Place UniFi Protect AI Key devices behind a firewall and limit inbound traffic to known administrator source addresses.
- Disable remote access to the device management interface where not required for operations.
- Enforce network segmentation between surveillance infrastructure and general-purpose user networks.
# Example firewall restriction limiting access to the UniFi Protect AI Key
# Replace interface, source, and destination values for your environment
iptables -A INPUT -i eth0 -s 10.10.10.0/24 -d 192.168.1.50 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i eth0 -d 192.168.1.50 -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
