Summary
CVE-2026-77552 is a critical improper input validation vulnerability (CWE-20) in Ubiquiti’s UniFi Enterprise Audio/Video Bridge that allows a network-accessible, unauthenticated attacker to inject and execute arbitrary operating system commands on the device. The flaw carries a CVSS v3.1 base score of 9.8 (Critical), reflecting network exploitability with no privileges or user interaction required and full impact on confidentiality, integrity, and availability.
Technical details
- Root cause: Improper input validation (CWE-20) in the UniFi Enterprise Audio/Video Bridge allows attacker-supplied input to be processed in a way that permits command injection.
- Trigger conditions: An attacker sends crafted network input to a vulnerable, internet- or network-exposed device running an affected firmware version.
- Attack vector: Network-based, no authentication or user interaction required, low attack complexity.
- Impact: Successful exploitation allows arbitrary command execution on the device, resulting in complete loss of confidentiality, integrity, and availability of the device.
Affected software
- UniFi Enterprise Audio/Video Bridge: all versions before 1.0.11
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Upgrade UniFi Enterprise Audio/Video Bridge firmware to version 1.0.11 or later, as published in Ubiquiti’s Security Advisory Bulletin 067.
- If patching is not immediately possible: Restrict network exposure of the device — remove it from direct internet access, place it behind a firewall/VPN, and limit management access to trusted networks only until the update can be applied.

