Vulnerability · Published Oct 30, 2025 · Assigned by hackerone
CVE-2025-52665
Critical 10.0
In plain English
A critical-severity missing authentication in UniFi Access Application from Ubiquiti Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 41.1% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later. Affected Products: UniFi Access Application (Version 3.3.22 through 3.4.31). Mitigation: Update your UniFi Access Application to Version 4.0.21 or later.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ubiquiti Inc | UniFi Access Application | 3.3.22 – through 3.4.31 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H