CVE-2026-110458 in UniFi Protect AI Key
Summary
by MITRE • 10/14/2026
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The discovery of a path traversal vulnerability within the UniFi Protect AI Key represents a significant security risk for organizations relying on this hardware appliance for video surveillance and analytics. This specific flaw allows an attacker who has established access to the local network, potentially through compromised credentials or by exploiting other lateral movement techniques, to manipulate file system operations in unintended ways. The core technical issue stems from insufficient validation of user-supplied input when constructing file paths. In a typical secure implementation, any directory traversal sequences such as dot-dot-slash (../) should be strictly sanitized or rejected before being passed to the operating system's file handling functions. However, due to this oversight in the application logic, an attacker can inject these sequences into API requests or configuration parameters, effectively breaking out of the intended sandboxed directories and accessing arbitrary locations on the device’s storage medium.
The operational impact of this vulnerability is severe because it grants the ability to create new files or truncate existing ones at will within the file system hierarchy accessible by the application process. Truncating critical log files could allow an attacker to erase evidence of their intrusion, thereby hindering forensic analysis and incident response efforts. Conversely, creating malicious files in specific directories might enable further exploitation vectors, such as injecting web shells if writable directories overlap with those served by internal web interfaces, or corrupting configuration files that control the behavior of the AI key itself. This level of file system manipulation undermines the integrity and availability aspects of the CIA triad, potentially leading to service disruption or providing a foothold for more advanced persistent threats within the network infrastructure.
From an industry standards perspective, this vulnerability aligns directly with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which categorizes flaws where software does not properly neutralize special elements that can cause paths to traverse outside of intended directories. Furthermore, in terms of tactical classification under the MITRE ATT&CK framework, this exploitation technique falls under T1083: File and Directory Discovery or potentially T1564: Hide Execution Artifacts if used for log deletion. The attack vector is classified as Network (T1072) because it requires network access to interact with the device's management interface or API endpoints, rather than requiring physical interaction or local code execution on the endpoint itself.
Mitigation strategies must prioritize immediate patching by applying the latest firmware updates released by Ubiquiti Inc., which address these input validation flaws. In environments where patching is not immediately feasible, network segmentation should be enforced to restrict access to the UniFi Protect AI Key from untrusted or general-purpose user networks. Access control lists on firewalls and switches can limit connectivity to only those IP addresses that require administrative interaction with the device. Additionally, implementing strict input validation at the application layer for any exposed APIs is crucial to prevent similar path traversal attempts in future versions. Regular auditing of file system permissions ensures that even if an attacker gains partial access, they are restricted from writing or modifying critical system files outside of designated temporary directories.