Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2025-23091

An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM) attack during appli

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM) attack during application update.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Ubiquiti Inc UDM

Default version status: unaffected

  • 4.1.13 to < 4.1.13affected

Ubiquiti Inc UDM-Pro

Default version status: unaffected

  • 4.1.13 to < 4.1.13affected

Ubiquiti Inc UDM-SE

Default version status: unaffected

  • 4.1.13 to < 4.1.13affected

Ubiquiti Inc UDM-Pro-Max

Default version status: unaffected

  • 4.1.13 to < 4.1.13affected

Ubiquiti Inc UDW

Default version status: unaffected

  • 4.1.13 to < 4.1.13affected

Ubiquiti Inc UNVR

Default version status: unaffected

  • 4.1.11 to < 4.1.11affected

Ubiquiti Inc UNVR PRO

Default version status: unaffected

  • 4.1.11 to < 4.1.11affected

Ubiquiti Inc UCKP

Default version status: unaffected

  • 4.1.11 to < 4.1.11affected

Ubiquiti Inc UCK

Default version status: unaffected

  • 4.1.11 to < 4.1.11affected

Ubiquiti Inc UCK-Enterprise

Default version status: unaffected

  • 4.1.11 to < 4.1.11affected

Ubiquiti Inc UCG-Max

Default version status: unaffected

  • 4.1.13 to < 4.1.13affected

Ubiquiti Inc EFG

Default version status: unaffected

  • 4.1.13 to < 4.1.13affected

References