CVE-2025-23091

published 2025-02-01

CVE-2025-23091: An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle…

Priority P4 30 medium 5.9 CVSS 3.0

AV N AC H PR N UI N S U C N I H A N

An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM) attack during application update.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
ubiquiti_inc	efg	>= 4.1.13 < 4.1.13	4.1.13
ubiquiti_inc	ucg-max	>= 4.1.13 < 4.1.13	4.1.13
ubiquiti_inc	uck	>= 4.1.11 < 4.1.11	4.1.11
ubiquiti_inc	uck-enterprise	>= 4.1.11 < 4.1.11	4.1.11
ubiquiti_inc	uckp	>= 4.1.11 < 4.1.11	4.1.11
ubiquiti_inc	udm	>= 4.1.13 < 4.1.13	4.1.13
ubiquiti_inc	udm-pro	>= 4.1.13 < 4.1.13	4.1.13
ubiquiti_inc	udm-pro-max	>= 4.1.13 < 4.1.13	4.1.13
ubiquiti_inc	udm-se	>= 4.1.13 < 4.1.13	4.1.13
ubiquiti_inc	udw	>= 4.1.13 < 4.1.13	4.1.13
ubiquiti_inc	unvr	>= 4.1.11 < 4.1.11	4.1.11
ubiquiti_inc	unvr_pro	>= 4.1.11 < 4.1.11	4.1.11

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-295