Cryptographic Weakness in Ubiquiti UniFi Network Controller and Devices

CVE-2019-25651

What is CVE-2019-25651?

The Ubiquiti UniFi Network Controller and associated devices exhibit a significant cryptographic flaw due to their use of AES-CBC mode for device-to-controller communication. This vulnerability allows attackers with adjacent network access to capture encrypted traffic, which can be exploited to recover encryption keys. Once attackers derive these keys, they can gain unauthorized control over network devices, compromising the integrity and security of the network. It is crucial for users to upgrade their devices to the latest firmware versions to mitigate this risk.

References