CVE-2026-22562: Path Traversal in UniFi Play PowerAmp and Audio Port Firmware

Overview

CVE-2026-22562 is a path traversal weakness (CWE-22) in the firmware of two UniFi Play devices: UniFi Play PowerAmp and UniFi Play Audio Port. According to the CVE description, an actor with access to the UniFi Play network could use the flaw to write files on the device, which could be used for remote code execution. The record was published on 2026-04-13 and carries the source status Deferred.

Impact

• The only severity score in the record is a CVSS 3.1 base score of 9.8 assigned by the CNA, with vector components indicating network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
• The description links the weakness to possible remote code execution (RCE).
• Because the description refers to access to the UniFi Play network, network segmentation and access control are directly relevant to exposure.

Affected products and versions

• UniFi Play PowerAmp: version 1.0.35 and earlier, according to the CVE description.
• UniFi Play Audio Port: version 1.0.24 and earlier, according to the CVE description.

The structured affected-product list in the record is empty, so the version ranges above come from the description text only.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, so no active exploitation is confirmed by that source. No confirmed exploitation appears in the sources consulted. The EPSS probability in the record is about 0.77%, which is an estimate of exploitation likelihood and not evidence of exploitation.

Remediation and mitigation

• Update UniFi Play PowerAmp to version 1.0.38 or later, as stated in the CVE description.
• Update UniFi Play Audio Port to version 1.1.9 or later, as stated in the CVE description.
• Inventory all UniFi Play devices and their firmware versions, including devices that may not be actively managed.
• Until the update is applied, limit which hosts and users can reach the UniFi Play network, and restrict access to the device management interfaces to trusted segments.
• Consult the vendor advisory referenced in the record for the authoritative remediation guidance.

Detection guidance

• Review device firmware versions against the thresholds above to identify systems still running affected versions.
• Monitor for unexpected file creation or modification on UniFi Play devices, and for configuration or firmware changes that were not authorized.
• Review network logs for unusual access to UniFi Play devices from hosts that do not require it.

Limitations of the available information

• The record does not include a structured list of affected or fixed versions, so the version information depends on the description text.
• The record does not describe the specific file paths, the exact exploitation conditions, or the attack prerequisites beyond network access.
• The only score in the record is from the CNA; no separate NVD score is included.
• The vendor advisory was not reviewed beyond the reference URL listed in the record, so vendor-specific details may be missing.
• No exploitation information is available beyond the KEV status and EPSS value in the record.

Frequently asked questions

Which UniFi Play versions are affected by CVE-2026-22562?

According to the CVE description, UniFi Play PowerAmp version 1.0.35 and earlier and UniFi Play Audio Port version 1.0.24 and earlier are affected. The structured affected-product list in the record is empty.

Is CVE-2026-22562 known to be exploited in the wild?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.