Skip to content
OpenAdvisories
Medium · 5.9 CVE-2025-23091 EUVD-2025-3119GHSA-j57h-g9hv-4p44

An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man…

Published Feb 1, 2025 · Updated Mar 13, 2025 · Assigned by hackerone

Vendor: Ubiquiti Product: EFG Product: UCG-Max Product: UCK Product: UCK-Enterprise Product: UCKP Product: UDM Product: UDM-Pro Product: UDM-Pro-Max Product: UDM-SE Product: UDW Product: UNVR Product: UNVR-Pro Category: Network devices

Description

An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM) attack during application update.

Affected products

VendorProductAffectedFixed
Ubiquiti UDM 4.1.13 – < 4.1.13 4.1.13
Ubiquiti UDM-Pro 4.1.13 – < 4.1.13 4.1.13
Ubiquiti UDM-SE 4.1.13 – < 4.1.13 4.1.13
Ubiquiti UDM-Pro-Max 4.1.13 – < 4.1.13 4.1.13
Ubiquiti UDW 4.1.13 – < 4.1.13 4.1.13
Ubiquiti UNVR 4.1.11 – < 4.1.11 4.1.11
Ubiquiti UNVR PRO 4.1.11 – < 4.1.11 4.1.11
Ubiquiti UCKP 4.1.11 – < 4.1.11 4.1.11
Ubiquiti UCK 4.1.11 – < 4.1.11 4.1.11
Ubiquiti UCK-Enterprise 4.1.11 – < 4.1.11 4.1.11
Ubiquiti UCG-Max 4.1.13 – < 4.1.13 4.1.13
Ubiquiti EFG 4.1.13 – < 4.1.13 4.1.13

Advisories 1

References