CVE-2026-22564: UniFi Play Auth Bypass Vulnerability

CVE-2026-22564 Overview

An Improper Access Control vulnerability has been identified in Ubiquiti UniFi Play network audio devices that could allow a malicious actor with access to the UniFi Play network to enable SSH and make unauthorized changes to the system. This critical security flaw affects the device firmware's access control mechanisms, potentially enabling attackers to gain persistent administrative access to affected systems.

Critical Impact

Attackers with network access to vulnerable UniFi Play devices can enable SSH to gain unauthorized system access, potentially leading to complete device compromise, lateral movement within the network, and persistent backdoor installation.

Affected Products

• UniFi Play PowerAmp (Version 1.0.35 and earlier)
• UniFi Play Audio Port (Version 1.0.24 and earlier)

Discovery Timeline

• April 13, 2026 - CVE CVE-2026-22564 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22564

Vulnerability Analysis

This vulnerability is classified under CWE-284 (Improper Access Control), indicating that the affected UniFi Play devices fail to properly restrict access to sensitive administrative functions. The core issue lies in how the firmware handles authentication and authorization for enabling SSH services on the device.

The vulnerability allows an attacker who has gained access to the UniFi Play network segment to bypass access control mechanisms and enable SSH services without proper authentication. Once SSH is enabled, the attacker can establish a direct connection to the device's underlying operating system, gaining the ability to execute arbitrary commands, modify system configurations, and potentially install persistent malware or backdoors.

The attack requires network-level access to the UniFi Play network segment but does not require any prior authentication or user interaction, making it particularly dangerous in environments where network segmentation is insufficient.

Root Cause

The root cause of this vulnerability stems from improper implementation of access control checks within the UniFi Play firmware. The device fails to adequately verify that requests to enable SSH services originate from authorized administrative sessions. This allows any network-adjacent attacker to manipulate device settings that should be restricted to authenticated administrators only.

The access control bypass appears to affect the device management interface, where critical security settings like SSH enablement are not properly protected by authentication requirements or are vulnerable to bypass techniques.

Attack Vector

The attack vector for CVE-2026-22564 involves network-based exploitation where an attacker with access to the UniFi Play network segment can send specially crafted requests to vulnerable devices. The exploitation flow typically follows this pattern:

1. Attacker gains access to the network segment where UniFi Play devices are deployed
2. Attacker identifies vulnerable UniFi Play PowerAmp or Audio Port devices on the network
3. Attacker sends requests to enable SSH services, bypassing access control mechanisms
4. Once SSH is enabled, attacker establishes direct shell access to the device
5. Attacker can now execute arbitrary commands, modify configurations, or install persistent backdoors

The attack does not require user interaction and can be executed remotely over the network, making it suitable for automated exploitation.

Detection Methods for CVE-2026-22564

Indicators of Compromise

• Unexpected SSH service enablement on UniFi Play devices that were previously configured without SSH access
• Unauthorized SSH connections to UniFi Play devices from unknown or unexpected IP addresses
• Configuration changes to UniFi Play devices without corresponding authorized administrative actions
• Unusual outbound network traffic from UniFi Play devices indicating potential command-and-control communication

Detection Strategies

• Implement network monitoring to detect SSH traffic (port 22) to and from UniFi Play devices
• Enable logging on network infrastructure to capture connection attempts to UniFi Play device management interfaces
• Deploy intrusion detection rules to identify unauthorized configuration change attempts against IoT and audio devices
• Conduct regular firmware version audits to identify devices running vulnerable versions (1.0.35 or earlier for PowerAmp, 1.0.24 or earlier for Audio Port)

Monitoring Recommendations

• Configure network monitoring tools to alert on any SSH service activation on UniFi Play network segments
• Establish baseline network behavior for UniFi Play devices and alert on deviations
• Monitor for unauthorized administrative access patterns across the UniFi Play infrastructure
• Implement asset inventory tracking to ensure all devices are identified and firmware versions are documented

How to Mitigate CVE-2026-22564

Immediate Actions Required

• Inventory all UniFi Play PowerAmp and Audio Port devices in your environment and identify those running vulnerable firmware versions
• Isolate vulnerable UniFi Play devices on dedicated network segments with strict access controls until patches can be applied
• Apply firmware updates immediately: UniFi Play PowerAmp to Version 1.0.38 or later, UniFi Play Audio Port to Version 1.1.9 or later
• Review SSH access logs on all UniFi Play devices for signs of unauthorized access or configuration changes

Patch Information

Ubiquiti has released firmware updates to address this vulnerability. Organizations should apply the following updates as soon as possible:

For detailed patch information and download links, refer to the UI Community Security Advisory Bulletin 063.

Workarounds

• Implement network segmentation to isolate UniFi Play devices from untrusted network segments
• Deploy firewall rules to restrict access to UniFi Play device management interfaces to authorized administrator IP addresses only
• Disable SSH on UniFi Play devices if it is not required for operational purposes and verify the configuration cannot be changed remotely
• Monitor network traffic for unauthorized attempts to access device management ports

# Network segmentation example - restrict access to UniFi Play devices
# Apply these rules on your network firewall or router

# Allow only authorized management stations to access UniFi Play devices
iptables -A FORWARD -s 192.168.1.100 -d 192.168.10.0/24 -p tcp --dport 22 -j ACCEPT
iptables -A FORWARD -d 192.168.10.0/24 -p tcp --dport 22 -j DROP

# Block unauthorized access to management interfaces
iptables -A FORWARD -d 192.168.10.0/24 -p tcp --dport 443 -j DROP
iptables -A FORWARD -s 192.168.1.100 -d 192.168.10.0/24 -p tcp --dport 443 -j ACCEPT