Ubiquiti UniFi Protect AI Key: Command injection via improper input validation
Summary
An improper input validation flaw in the UniFi Protect AI Key, an AI-based threat detection add-on for UniFi Protect, allows command injection on the device. An attacker with network access can execute commands on the device under certain conditions. The CNA rates the CVSS score 8.1 (High); no login or user action is required, but attack complexity is high.
Affected
- UniFi Protect AI Key firmware versions 0 to below 2.2.8 (according to the CNA record)
- Versions 2.2.7 and below are presumably affected; not confirmed against the vendor advisory.
Fixed in
- Firmware 2.2.8 (according to research notes citing vendor information; verify in Security Advisory Bulletin 070)
Workaround
- Unknown. No vendor workaround is documented in the sources reviewed.
- Restrict network access to the AI Key to the UniFi Protect controller until firmware 2.2.8 is installed.
Exploitation
- No confirmed exploitation in the sources reviewed.
- Not listed in CISA KEV according to a third-party tracker; verify on the CISA website.
- A Sploitus entry carries a PoC title but contains no exploit content; no evidence of a working public exploit.
Our recommendation
- Inventory all UniFi Protect AI Key devices and their firmware versions.
- Check the installed UniFi Protect version first, because Protect 7.2.105 requires AI Key firmware 2.2 or newer.
- Update all AI Key devices below 2.2.8 to 2.2.8, together with the related flaws in the same advisory.
- Confirm the fixed version directly in Security Advisory Bulletin 070.
- Place the AI Key on a restricted management or camera VLAN until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Ubiquiti Security Advisory Bulletin 070 community.ui.com
- Vulners CVE record CVE-2026-110455 vulners.com
- Cybernews: UniFi AI Key vulnerabilities advisory cybernews.com
- Strix CVE-2026-110455 www.strix.ai
- CVE.threatint CVE-2026-110455 cve.threatint.com
- UniFi Protect release feed community.ui.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:11.
Original description (NVD)
A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.