Improper Certificate Validation on UniFi OS Devices by Ubiquiti
CVE-2025-23091

5.9MEDIUM

Key Information:

Vendor

Ubiquiti Inc

Status
Udm
Udm-pro
Udm-se
Udm-pro-max
Vendor
CVE Published:
1 February 2025

What is CVE-2025-23091?

An improper certificate validation vulnerability in UniFi OS devices configured with Identity Enterprise can lead to a potential man-in-the-middle (MitM) attack during application updates. This flaw allows malicious actors to intercept communications, posing significant risks to the integrity and confidentiality of data transmitted during the update process.

Affected Version(s)

EFG 4.1.13

UCG-Max 4.1.13

UCK 4.1.11

References

https://community.ui.com/releases/Security-Advisory-Bulle...

CVSS V3.0

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-23091 : Improper Certificate Validation on UniFi OS Devices by Ubiquiti