External risk intelligence

UniFi Enterprise Audio/Video Bridge Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-77552

The vulnerability affects an Enterprise Audio/Video Bridge, which is typically deployed on internal or private networks to manage local multimedia traffic. While network-reachable, these devices are not generally intended to be exposed directly to the public internet in standard deployments, making internet-facing exposure possible but not a common default configuration.

Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in UniFi Enterprise Audio/Video Bridges allows an attacker on the network to inject commands, potentially leading to system compromise. While these devices are not typically internet-facing, their presence on the network warrants attention to confirm relevance and exposure.

Flaw lets attackers control audio/video devices.
Critical flaw impacts network-connected devices.
Confirm impact and exposure to secure systems.

Attack Path

How an attacker could exploit the issue

A remote attacker with network access can exploit an improper input validation flaw in the UniFi Enterprise Audio/Video Bridge. By sending specially crafted network requests, an attacker can trick the device into executing arbitrary commands, leading to a complete compromise of the system.

Network access required.
Vulnerable input validation allows command execution.
Leads to system compromise.

Live Threat

Current exploitation, exposure, and threat context

A Command Injection vulnerability in the UniFi Enterprise Audio/Video Bridge could allow a network-accessing attacker to execute arbitrary commands on the device. This could impact the device's functionality and potentially lead to unauthorized access or control.

Device commands and configuration.
Network access to send malicious input.
Unauthorized access and control of the device.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability impacts UniFi Enterprise Audio/Video Bridges, making them susceptible to command injection via network access. Responsibility likely falls to infrastructure or platform teams managing these devices, in coordination with network and security teams. The immediate first step involves identifying all deployed bridges, assessing their network reachability and business criticality, and then confirming the accountable owner to plan a risk-based remediation.

Infrastructure and security teams own remediation.
Verify all deployed bridge instances.
Plan coordinated, risk-based action.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the UniFi Enterprise Audio/Video Bridge?

The UniFi Enterprise Audio/Video Bridge is a specialized piece of networking hardware designed to bridge multimedia traffic across enterprise environments. It serves as a central hub for managing audio and video streams, ensuring that media signals are routed efficiently between components on a unified network. These devices are generally deployed in corporate or specialized settings to maintain consistent A/V performance across a local infrastructure.

How does CVE-2026-77552 work?

This vulnerability is classified as Improper Input Validation (CWE-20). In simple terms, the device fails to properly check the data it receives from the network. Because the software does not filter this information correctly, an attacker can send specially crafted requests that the device misinterprets as legitimate system commands, resulting in unauthorized command execution.

What is required to trigger this vulnerability?

To trigger this command injection, an attacker must have network access to the device. The flaw is not triggered by standard, intended multimedia traffic. Instead, it requires the transmission of specific, malicious network requests designed to bypass the device's input security. Without the ability to communicate directly with the bridge over the network, an attacker cannot exploit this weakness.

Do I need to worry if my bridge is not on the internet?

While Halo Surface Signal notes that these bridges are not typically intended to be exposed to the public internet, they are still reachable via internal or private networks. If an attacker gains access to your internal network—even if the device is not internet-facing—the device remains at risk. You should verify your network segmentation to ensure that only authorized users and systems can communicate with these bridges.

What should I do first to manage this risk?

Your first step is to create an inventory of all UniFi Enterprise Audio/Video Bridges currently active in your environment. Once you have identified these devices, determine which network segments they occupy and evaluate their business importance. Coordinate with your infrastructure and security teams to confirm device ownership, which will allow you to plan a structured, risk-based approach to applying necessary updates or security configurations.

References

community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.