CVE-2025-23091
An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM) attack during application update.
- Score
- CVSS 3.0 5.9 Medium
- Status
- Deferred - support@hackerone.com
- Published
- 2025-02-01
- Last modified
- 2025-03-13
- Weaknesses
- CWE-295
Affected products
- Efg (Ubiquiti Inc)
- Ucg-max (Ubiquiti Inc)
- Uck (Ubiquiti Inc)
- Uck-enterprise (Ubiquiti Inc)
- Uckp (Ubiquiti Inc)
- Udm (Ubiquiti Inc)
- Udm-pro (Ubiquiti Inc)
- Udm-pro-max (Ubiquiti Inc)
- Udm-se (Ubiquiti Inc)
- Udw (Ubiquiti Inc)
- Unvr (Ubiquiti Inc)
- Unvr Pro (Ubiquiti Inc)
References
- https://community.ui.com/releases/Security-Advisory-Bulletin-045-045/6011bc61-f2eb-457f-b71d-755703817aaf
