CVE-2026-22562: UniFi Play Path Traversal Vulnerability

CVE-2026-22562 Overview

A critical Path Traversal vulnerability has been identified in Ubiquiti UniFi Play device firmware that allows a malicious actor with network access to write arbitrary files to the system. This file write capability can be leveraged to achieve remote code execution (RCE) on affected devices, potentially compromising the entire UniFi Play network infrastructure.

Critical Impact

Attackers with access to the UniFi Play network can exploit this path traversal flaw to write malicious files and execute arbitrary code remotely, potentially gaining full control of affected audio devices.

Affected Products

• UniFi Play PowerAmp (Version 1.0.35 and earlier)
• UniFi Play Audio Port (Version 1.0.24 and earlier)

Discovery Timeline

• April 13, 2026 - CVE-2026-22562 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22562

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal or Directory Traversal. The flaw exists within the device firmware of UniFi Play audio equipment, where user-supplied input containing path traversal sequences (such as ../) is not properly sanitized before being used in file system operations.

When an attacker exploits this vulnerability, they can escape the intended directory structure and write files to arbitrary locations on the device's file system. This arbitrary file write primitive is particularly dangerous because it can be weaponized to achieve remote code execution by overwriting critical system files, placing malicious scripts in auto-execution paths, or modifying configuration files to inject code.

The network-based attack vector means that any entity with access to the UniFi Play network segment can potentially exploit this vulnerability without requiring authentication or user interaction.

Root Cause

The root cause of CVE-2026-22562 lies in insufficient input validation within the firmware's file handling routines. The vulnerable code fails to properly sanitize path components before constructing file paths, allowing attackers to use directory traversal sequences like ../ to navigate outside the intended working directory. This lack of path canonicalization or validation enables writing files to sensitive system locations.

Attack Vector

The attack is network-based, requiring the attacker to have access to the UniFi Play network. The exploitation flow involves:

1. The attacker crafts a malicious request containing path traversal sequences targeting the vulnerable firmware endpoint
2. The firmware processes the request without properly validating the path components
3. The attacker-controlled content is written to an arbitrary location on the file system
4. By writing to strategic locations (such as startup scripts, cron directories, or web server roots), the attacker achieves code execution

The path traversal vulnerability allows an attacker to craft specially formatted requests that include directory traversal sequences (e.g., ../../) to escape the intended directory and write files to arbitrary system locations. By targeting writable system paths such as init scripts, scheduled task directories, or configuration files, the attacker can achieve persistent code execution when the system processes these malicious files. For detailed technical information, refer to the UI Community Security Advisory.

Detection Methods for CVE-2026-22562

Indicators of Compromise

• Unexpected files appearing in system directories outside normal firmware update paths
• Modified startup scripts, cron jobs, or configuration files with unauthorized content
• Network traffic containing path traversal patterns (../, ..%2f, %2e%2e/) targeting UniFi Play devices
• Anomalous outbound connections from UniFi Play devices indicating potential reverse shells

Detection Strategies

• Monitor network traffic to/from UniFi Play devices for requests containing path traversal sequences
• Implement file integrity monitoring on UniFi Play devices to detect unauthorized file modifications
• Deploy network-based intrusion detection rules to identify exploitation attempts targeting path traversal patterns
• Review device logs for unusual file write operations or error messages indicating traversal attempts

Monitoring Recommendations

• Segment UniFi Play devices onto a dedicated VLAN with strict access controls and monitoring
• Implement network traffic analysis to baseline normal UniFi Play communication patterns and alert on deviations
• Configure SIEM rules to correlate path traversal indicators across multiple data sources
• Establish periodic firmware integrity checks against known-good baselines

How to Mitigate CVE-2026-22562

Immediate Actions Required

• Update UniFi Play PowerAmp devices to Version 1.0.38 or later immediately
• Update UniFi Play Audio Port devices to Version 1.1.9 or later immediately
• Restrict network access to UniFi Play devices to only authorized management systems
• Audit UniFi Play devices for signs of compromise before and after patching

Patch Information

Ubiquiti has released firmware updates that address this path traversal vulnerability. Organizations should apply the following updates as a priority:

For complete patch details and download links, refer to the UI Community Security Advisory.

Workarounds

• Implement network segmentation to isolate UniFi Play devices from untrusted network segments
• Deploy firewall rules to restrict access to UniFi Play management interfaces to authorized IP addresses only
• Enable logging and monitoring on network devices to detect and alert on suspicious traffic patterns
• Consider temporarily disabling affected devices if patching cannot be performed immediately and risk is unacceptable

# Example: Network segmentation firewall rule to restrict access to UniFi Play devices
# Allow only management subnet to access UniFi Play network segment
iptables -A FORWARD -s 10.0.1.0/24 -d 10.0.10.0/24 -j ACCEPT
iptables -A FORWARD -d 10.0.10.0/24 -j DROP