External risk intelligence

UniFi Connect Display Cast Privilege Escalation Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-77551

The affected device, UniFi Connect Display Cast, is typically deployed as a signage or display endpoint within an internal local area network. While network-reachable, these devices are generally not exposed directly to the public internet in common deployments and usually reside behind internal network controls.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in UniFi Connect Display Cast Pro devices, allowing unauthorized individuals to gain elevated control over the device if they can access the network and meet specific conditions. The primary concern is to determine if our organization utilizes this specific technology and if it is exposed to potential network threats.

Device vulnerability allows unauthorized control.
Confirm if this technology is in use.
Assess exposure and relevance to our environment.

Attack Path

How an attacker could exploit the issue

An attacker on the network could exploit this improper access control flaw by targeting the UniFi Connect Display Cast Pro. Successful exploitation allows the attacker to gain elevated privileges on the device.

Requires network access and specific conditions.
Exploits improper access control.
Leads to privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

A malicious actor, under specific conditions and with network access, could potentially exploit an improper access control vulnerability in UniFi Connect Display Cast Pro devices. This could allow for an escalation of privileges on the device, potentially affecting its intended function and any network services it interacts with.

Device and network control.
Exploiting improper access controls.
Unauthorized privilege escalation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This Improper Access Control vulnerability in UniFi Connect Display Cast Pro could allow a network-based attacker to escalate privileges. Initial triage involves identifying affected devices, confirming their reachability and business criticality, and locating the accountable owner. Remediation planning should then be prioritized based on the assessed risk.

Asset owners should manage the issue.
Verify device reachability and business criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the UniFi Connect Display Cast Pro?

UniFi Connect Display Cast Pro is a specialized hardware endpoint designed for digital signage and content broadcasting. It connects to displays to manage and project visual information across professional environments, acting as a network-attached player that interprets and renders media feeds for information or advertising purposes.

What does improper access control mean for CVE-2026-77551?

This vulnerability falls under the CWE-284 weakness class, meaning the device fails to correctly verify or restrict user permissions. In the context of this CVE, it allows an unauthorized person to bypass established security boundaries, granting them elevated rights or administrative control over the device functions that they should not normally be able to access.

How can an attacker trigger this vulnerability?

An attacker must have existing network access to the device to attempt exploitation. The bug is not triggered by simple, generic network traffic; it requires specific, complex conditions to be met during communication with the device. It is not exploitable by users who lack network reachability to the unit.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that the risk is unlikely for most organizations because these devices are typically placed on internal, private networks rather than the public internet. Since the device functions as an endpoint for signage, it usually resides behind standard network defenses, limiting the pool of potential attackers who can reach it.

Do I need to take immediate action for this CVE?

You should begin by identifying if you have UniFi Connect Display Cast Pro units deployed in your environment. Once located, verify the network placement of these devices to understand their accessibility. Finally, coordinate with the asset owners to track official updates and prepare to apply patches as they become available for your hardware.

References

community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.