Vulnerability · Published Jun 29, 2025 · Assigned by hackerone
CVE-2025-24292
Medium 6.8
In plain English
A medium-severity improper authentication in UniFi Network Application from Ubiquiti Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.0)6.8Medium
Exploit odds (30 days)0.4%top 71.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A misconfigured query in UniFi Network (v9.1.120 and earlier) could allow users to authenticate to Enterprise WiFi or VPN Server (l2tp and OpenVPN) using a device’s MAC address from 802.1X or MAC Authentication, if both services are enabled and share the same RADIUS profile.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ubiquiti Inc | UniFi Network Application | 9.2.87 – before 9.2.87 |
Weakness: CWE-287 · Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N