by Kastro
Paper/Archive/CVE-2025-27212

CVE-2025-27212

Ubiquiti Inc UniFi Access Reader Pro — An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Ac…

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 66.3.663 × 2013.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network. Affected Products: UniFi Access Reader Pro (Version 2.14.21 and earlier) UniFi Access G2 Reader Pro (Version 1.10.32 and earlier) UniFi Access G3 Reader Pro (Version 1.10.30 and earlier) UniFi Access Intercom (Version 1.7.28 and earlier) UniFi Access G3 Intercom (Version 1.7.29 and earlier) UniFi Access Intercom Viewer (Version 1.3.20 and earlier) Mitigation: Update UniFi Access Reader Pro Version 2.15.9 or later Update UniFi Access G2 Reader Pro Version 1.11.23 or later Update UniFi Access G3 Reader Pro Version 1.11.22 or later Update UniFi Access Intercom Version 1.8.22 or later Update UniFi Access G3 Intercom Version 1.8.22 or later Update UniFi Access Intercom Viewer Version 1.4.39 or later

Affected

ProductAffectedFixed inSource
UniFi Access Reader Pro2.15.9 – < 2.15.92.15.9CNA
UniFi Access G2 Reader Pro1.11.23 – < 1.11.231.11.23CNA
UniFi Access G3 Reader Pro1.11.22 – < 1.11.221.11.22CNA
UniFi Access Intercom1.8.22 – < 1.8.221.8.22CNA
UniFi Access G3 Intercom1.8.22 – < 1.8.221.8.22CNA
UniFi Access Intercom Viewer1.4.39 – < 1.4.391.4.39CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcommunity.ui.com/releases/Security-Advisory-Bulletin-051-051/583fa6e1-3d85-42ec-a453-651d1653c9b3