Critical · 9.1 CVE-2025-27217 EUVD-2025-25440GHSA-2789-ggx9-w3cc

A Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside …

Published Aug 21, 2025 · Updated Aug 21, 2025 · Assigned by hackerone

Vendor: Ubiquiti Product: UISP Application Category: Network devices

Description

A Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside of UISP Application scope.

Affected products

Vendor	Product	Affected	Fixed
Ubiquiti	UISP Application	2.4.220 – < 2.4.220	2.4.220

References

https://community.ui.com/releases/UISP-Application-2-4-220/b428b276-c4a6-4b90-b97b-1860ff2bb46d