CVE-2025-27212
📋 TL;DR
This CVE describes an improper input validation vulnerability in UniFi Access devices that allows command injection. An attacker with network access to the management interface can execute arbitrary commands on affected devices. All listed UniFi Access products with specified vulnerable versions are affected.
💻 Affected Systems
- UniFi Access Reader Pro
- UniFi Access G2 Reader Pro
- UniFi Access G3 Reader Pro
- UniFi Access Intercom
- UniFi Access G3 Intercom
- UniFi Access Intercom Viewer
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to execute arbitrary commands, potentially leading to lateral movement within the network, data exfiltration, or device bricking.
Likely Case
Unauthorized command execution on the device, potentially allowing privilege escalation, persistence establishment, or disruption of access control functions.
If Mitigated
Limited impact if proper network segmentation isolates management interfaces and regular patching is performed.
🎯 Exploit Status
Exploitation requires network access to management interface but no authentication. CVSS 9.8 indicates critical severity with low attack complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UniFi Access Reader Pro: 2.15.9+, UniFi Access G2 Reader Pro: 1.11.23+, UniFi Access G3 Reader Pro: 1.11.22+, UniFi Access Intercom: 1.8.22+, UniFi Access G3 Intercom: 1.8.22+, UniFi Access Intercom Viewer: 1.4.39+
Vendor Advisory: https://community.ui.com/releases/Security-Advisory-Bulletin-051-051/583fa6e1-3d85-42ec-a453-651d1653c9b3
Restart Required: Yes
Instructions:
1. Log into UniFi Network application. 2. Navigate to Devices section. 3. Select affected UniFi Access device. 4. Click Update button if firmware update is available. 5. Wait for device to download and install update. 6. Device will automatically restart after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate UniFi Access management interfaces from untrusted networks using firewall rules or VLAN segmentation.
Access Control Lists
allImplement strict network access controls to limit which IP addresses can reach UniFi Access management interfaces.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate UniFi Access devices from untrusted networks
- Monitor network traffic to UniFi Access management interfaces for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in UniFi Network application under Devices section for each UniFi Access device.Check Version:
No CLI command available. Check via UniFi Network application web interface.Verify Fix Applied:
Confirm firmware version has been updated to patched versions listed in mitigation section.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns in device logs
- Unexpected process creation or system modifications
Network Indicators:
- Unusual network connections from UniFi Access devices
- Suspicious traffic to/from management interfaces
SIEM Query:
source="unifi_access" AND (event_type="command_execution" OR process_name="unusual")