CVE-2025-52665

CRITICALNuclei

ui unifi_access Missing Authentication for Critical Function

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2025-52665 has a selected CVSS score of 10.0 (critical); EIP currently links 1 Nuclei template.

Description

A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later.  Affected Products: UniFi Access Application (Version 3.3.22 through 3.4.31). 
 Mitigation: Update your UniFi Access Application to Version 4.0.21 or later.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 16, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 31, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

UniFi Access Application

Browse Ubiquiti Inc / UniFi Access Application

Default status: unaffected

CVE List3.3.22 to ≤ 3.4.31affected

UniFi Access

Browse Ubiquiti, Inc / UniFi Access
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALUniFi Access - Broken Access ControlCVSS 10

UniFi Access Application 3.3.22 through 3.4.31 contains a broken authentication caused by misconfiguration exposing management API without proper authentication, letting attackers on management network access management functions, exploit requires network access.

Impact

Attackers on the management network can access management APIs without authentication, potentially leading to unauthorized control of the system.

Remediation

Update to version 4.0.21 or later.

WeaknessesCWE-306
Authorstheamanrawat, DhiyaneshDK
Template tagscvecve2025unifircevulnvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Shodan: http.html:"UniFi OS"
FOFA: body="UniFi OS"
https://community.ui.com/releases/Security-Advisory-Bulletin-056-056/ce97352d-91cd-40a7-a2f4-2c73b3b30191 https://www.catchify.sa/post/cve-2025-52665-rce-in-unifi-os-25-000 https://nvd.nist.gov/vuln/detail/CVE-2025-52665

Source: ProjectDiscovery

References

2