What happened
Verified via NVD REST API (CVE-2026-110459 published 2026-10-14, CVSS 8.6, CISA SSVC automatable=yes). Ubiquiti's Security Advisory Bulletin 070-070 covers a six-CVE cluster (110454–110459) fixed in 2.2.8: access-control failures, command injection, and file path traversal on the AI Key edge device.
Why it matters
The UniFi Protect AI Key performs on-device AI inference on camera feeds; a network-reachable access-control/code-execution hole on that edge device compromises the AI video-analysis pipeline and the local network position of cameras. Edge-AI devices are frequently left on trusted VLANs with unpatched admin surfaces — audit exposure and apply 2.2.8.
Attack vector
Network access to the device: improper access control allows unauthenticated information disclosure/unauthorized changes/DoS (CWE-284), and under certain conditions an improper-input-validation path yields command injection on the device (CVE-2026-110455).
Affected systems
UniFi Protect AI Key < 2.2.8
Mitigation
Upgrade UniFi Protect AI Key to >= 2.2.8 (Security Advisory Bulletin 070-070); segment AI-capable camera/NVR devices away from untrusted network segments.