Unintended internal debugging access affects Ubiquiti UniFi Talk devices

A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This issue could allow an attacker with access to the UniFi Talk management network to invoke internal debug operations through the device API. Affected Products: UniFi Talk Touch (Version 1.21.16 and earlier) UniFi Talk Touch Max (Version 2.21.22 and earlier) UniFi Talk G3 Phones (Version 3.21.26 and earlier) Mitigation: Update the UniFi Talk Touch to Version 1.21.17 or later. Update the UniFi Talk Touch Max to Version 2.21.23 or later. Update the UniFi Talk G3 Phones to Version 3.21.27 or later.

• UniFi Talk Touch from Ubiquiti Inc.: affected in Version 1.21.16 and earlier. Ubiquiti directs users to update to Version 1.21.17 or later.
• UniFi Talk Touch Max from Ubiquiti Inc.: affected in Version 2.21.22 and earlier. Ubiquiti directs users to update to Version 2.21.23 or later.
• UniFi Talk G3 Phones from Ubiquiti Inc.: affected in Version 3.21.26 and earlier. Ubiquiti directs users to update to Version 3.21.27 or later.

Other versions or product branches are not separately established by the record.

The flaw exists because internal debugging functionality remained unintentionally enabled on certain Ubiquiti Inc. UniFi Talk devices. An attacker can send requests to the device API to invoke internal debug operations; the specific endpoints, methods, and parameters are not disclosed in the available evidence. The documented reachability condition is access to the UniFi Talk management network. The supplied attributes indicate that authentication is not required, user interaction is not required, and attack complexity is low. The impact scope is stated to remain within the same device, but the implementation details and effective permissions of individual debug operations are unknown. No CWE is assigned in the record.

The vulnerability is reachable over the network from the UniFi Talk management network. The record states that no privileges and no user interaction are required, with low attack complexity. The supplied record marks public_exploit as false, but it does not establish whether the vulnerability has been exploited in real environments. No exploit sequence, specific endpoint, or payload is disclosed.

A successful invocation of an internal debug operation could produce unauthorized effects on a UniFi Talk device. The record identifies possible impact to confidentiality, integrity, and availability, but it does not specify what data could be read, what state could be changed, or which services could be disrupted. The stated scope remains within the same device. Operationally, affected voice endpoints may require isolation, validation, and updating, but the record provides no evidence of a real-world incident.

The vulnerability permits unauthorized internal operations on UniFi Talk voice devices from the management network. Depending on the operation invoked, the possible consequences include limited data disclosure, device-state changes, or service disruption; the record characterizes the impact as low across all three dimensions but does not identify the individual operations. Organizations may need to review management-network access, validate device inventories, and update each affected product line. The record does not establish that data was accessed, configuration was changed, or service was interrupted in a real environment.

1. Update UniFi Talk Touch to Version 1.21.17 or later.
2. Update UniFi Talk Touch Max to Version 2.21.23 or later.
3. Update UniFi Talk G3 Phones to Version 3.21.27 or later.
4. After updating, verify the installed version on each device and confirm that unintended internal debug access is no longer exposed.
5. Until updates can be applied, an organization may restrict the UniFi Talk management network to authorized administrative paths. This is a defensive measure inferred from the documented network precondition, not a replacement for the vendor update.

1. Inventory UniFi Talk Touch, UniFi Talk Touch Max, and UniFi Talk G3 Phones in the managed environment and record the software version running on each device.
2. Compare each device version with the affected and fixed boundaries listed in affected_summary.
3. Review network policies to identify which hosts, administrative accounts, or segments can reach the UniFi Talk management network.
4. Review device API telemetry, where available, for requests that invoke internal debug functionality. The specific operations and endpoints are not disclosed, so the available evidence does not support a precise IOC.
5. Do not treat the absence of matching log entries as proof of safety; confirm exposure through inventory and installed-version checks.