CVE-2025-23091

State: Published
Severity: 5.9 Medium
Published: Feb 1, 2025
Updated: Mar 13, 2025
Reserved: Jan 10, 2025

Description

An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM) attack during application update.

Scores

CVSS	Score	Vector	Source
3.0	5.9 Medium	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N	hackerone

Weaknesses

CWE-295 Improper Certificate Validation

Affected Products

Product	Versions
UDMUbiquiti Inc	4.1.13 to before 4.1.13Affected
UDM-ProUbiquiti Inc	4.1.13 to before 4.1.13Affected
UDM-SEUbiquiti Inc	4.1.13 to before 4.1.13Affected
UDM-Pro-MaxUbiquiti Inc	4.1.13 to before 4.1.13Affected
UDWUbiquiti Inc	4.1.13 to before 4.1.13Affected
UNVRUbiquiti Inc	4.1.11 to before 4.1.11Affected
UNVR PROUbiquiti Inc	4.1.11 to before 4.1.11Affected
UCKPUbiquiti Inc	4.1.11 to before 4.1.11Affected
UCKUbiquiti Inc	4.1.11 to before 4.1.11Affected
UCK-EnterpriseUbiquiti Inc	4.1.11 to before 4.1.11Affected
UCG-MaxUbiquiti Inc	4.1.13 to before 4.1.13Affected
EFGUbiquiti Inc	4.1.13 to before 4.1.13Affected

References

https://community.ui.com/releases/Security-Advisory-Bulletin-045-045/6011bc61-f2eb-457f-b71d-755703817aaf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.