Back to overview

CVE-2025-52665

CRITICAL
10.0
CVSS 3.1
Description
A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later.  Affected Products: UniFi Access Application (Version 3.3.22 through 3.4.31). 
 Mitigation: Update your UniFi Access Application to Version 4.0.21 or later.

Metadata

CVE ID
CVE-2025-52665
State
PUBLISHED
Assigner
hackerone
Reserved
2025-06-18 15:00 UTC
Published
2025-10-30 23:30 UTC
Last updated
2025-10-31 14:07 UTC
Primary CWE
CWE-306
CWE-306 Missing Authentication for Critical Function
Vendor / Product
Ubiquiti Inc / UniFi Access Application
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Ubiquiti Inc UniFi Access Application — 3.3.22 ≤ 3.4.31
Weakness (CWE)
CWESourceDescription
CWE-306 adp CWE-306 Missing Authentication for Critical Function
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 adp CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References (1)
Back to overview