CVE-2026-22565: UniFi Play DoS Vulnerability

CVE-2026-22565 Overview

CVE-2026-22565 is an Improper Input Validation vulnerability affecting Ubiquiti's UniFi Play series of audio devices. A malicious actor with access to the UniFi Play network can exploit this vulnerability to cause the device to stop responding, resulting in a denial of service condition.

Critical Impact

Network-accessible attackers can cause UniFi Play devices to become unresponsive, disrupting audio services across affected installations without requiring authentication or user interaction.

Affected Products

• UniFi Play PowerAmp (Version 1.0.35 and earlier)
• UniFi Play Audio Port (Version 1.0.24 and earlier)

Discovery Timeline

• April 13, 2026 - CVE-2026-22565 published to NVD
• April 14, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22565

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in the UniFi Play device firmware. The flaw allows attackers who have network access to the UniFi Play infrastructure to send specially crafted input that the device fails to properly validate, causing the device to enter an unresponsive state.

The attack can be conducted remotely over the network without requiring any privileges or user interaction. While the vulnerability does not impact confidentiality or integrity, it has a high impact on availability, effectively rendering the affected audio equipment inoperable until manually recovered.

Root Cause

The root cause is insufficient input validation in the firmware's network-facing components. When the affected UniFi Play devices receive malformed or unexpected input over the network, the firmware fails to properly sanitize or reject the invalid data. This lack of proper bounds checking or input verification allows specially crafted packets to trigger a condition that causes the device to hang or crash.

Attack Vector

The attack vector is network-based, requiring the attacker to have access to the same network segment where UniFi Play devices operate. The attack requires low complexity to execute and does not require authentication or privileges. Once an attacker identifies vulnerable UniFi Play devices on the network, they can send malicious input to trigger the denial of service condition.

The vulnerability mechanism involves sending crafted network packets to the UniFi Play device's listening services. When the device processes this input without adequate validation, it enters a failure state that causes it to stop responding to legitimate requests. For detailed technical information, refer to the UI Community Security Advisory.

Detection Methods for CVE-2026-22565

Indicators of Compromise

• UniFi Play devices becoming unresponsive or requiring manual restart
• Unusual network traffic patterns targeting UniFi Play device ports
• Repeated device failures or crashes in system logs
• Unexpected packet floods or malformed requests in network captures

Detection Strategies

• Monitor UniFi Play device health status for unexpected unresponsive states
• Implement network intrusion detection rules for anomalous traffic to UniFi Play devices
• Configure alerting for device connectivity losses in the UniFi management interface
• Review network flow data for unusual communication patterns targeting audio equipment

Monitoring Recommendations

• Enable logging on network infrastructure to capture traffic to and from UniFi Play devices
• Configure SNMP or other monitoring to track device availability and uptime
• Implement automated health checks that alert when devices fail to respond
• Maintain baseline network behavior profiles to detect deviation

How to Mitigate CVE-2026-22565

Immediate Actions Required

• Update UniFi Play PowerAmp to Version 1.0.38 or later immediately
• Update UniFi Play Audio Port to Version 1.1.9 or later immediately
• Restrict network access to UniFi Play devices using VLANs or firewall rules
• Audit network access to identify any unauthorized devices on the UniFi Play network segment

Patch Information

Ubiquiti has released firmware updates to address this vulnerability. Administrators should update affected devices to the patched versions as soon as possible:

• UniFi Play PowerAmp: Update to Version 1.0.38 or later
• UniFi Play Audio Port: Update to Version 1.1.9 or later

Firmware updates can be obtained through the UniFi management interface or directly from Ubiquiti. Refer to the UI Community Security Advisory for additional details.

Workarounds

• Segment UniFi Play devices onto a dedicated, isolated VLAN to limit attacker access
• Implement strict access control lists (ACLs) to restrict which systems can communicate with UniFi Play devices
• Deploy network-level filtering to block unauthorized traffic to affected devices
• Monitor affected devices closely until patches can be applied

# Example VLAN isolation for UniFi Play devices
# Configure firewall rules to restrict access to UniFi Play network segment
# Allow only authorized management systems and audio sources
iptables -A FORWARD -d 192.168.10.0/24 -s 192.168.1.100 -j ACCEPT  # Management host
iptables -A FORWARD -d 192.168.10.0/24 -j DROP  # Block all other traffic