{"id":"CVE-2025-23091","state":"PUBLISHED","title":"An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM) attack during appli","description":"An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM) attack during application update.","publishedAt":"2025-02-01T06:53:09.114Z","updatedAt":"2025-03-13T12:54:46.381Z","severity":{"score":5.9,"label":"Medium","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"hackerone"},"assigner":"hackerone","products":["Ubiquiti Inc UDM","Ubiquiti Inc UDM-Pro","Ubiquiti Inc UDM-SE","Ubiquiti Inc UDM-Pro-Max","Ubiquiti Inc UDW","Ubiquiti Inc UNVR","Ubiquiti Inc UNVR PRO","Ubiquiti Inc UCKP","Ubiquiti Inc UCK","Ubiquiti Inc UCK-Enterprise","Ubiquiti Inc UCG-Max","Ubiquiti Inc EFG"],"affected":[{"vendor":"Ubiquiti Inc","product":"UDM","defaultStatus":"unaffected","versions":[{"version":"4.1.13","status":"affected","lessThan":"4.1.13","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UDM-Pro","defaultStatus":"unaffected","versions":[{"version":"4.1.13","status":"affected","lessThan":"4.1.13","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UDM-SE","defaultStatus":"unaffected","versions":[{"version":"4.1.13","status":"affected","lessThan":"4.1.13","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UDM-Pro-Max","defaultStatus":"unaffected","versions":[{"version":"4.1.13","status":"affected","lessThan":"4.1.13","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UDW","defaultStatus":"unaffected","versions":[{"version":"4.1.13","status":"affected","lessThan":"4.1.13","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UNVR","defaultStatus":"unaffected","versions":[{"version":"4.1.11","status":"affected","lessThan":"4.1.11","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UNVR PRO","defaultStatus":"unaffected","versions":[{"version":"4.1.11","status":"affected","lessThan":"4.1.11","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UCKP","defaultStatus":"unaffected","versions":[{"version":"4.1.11","status":"affected","lessThan":"4.1.11","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UCK","defaultStatus":"unaffected","versions":[{"version":"4.1.11","status":"affected","lessThan":"4.1.11","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UCK-Enterprise","defaultStatus":"unaffected","versions":[{"version":"4.1.11","status":"affected","lessThan":"4.1.11","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UCG-Max","defaultStatus":"unaffected","versions":[{"version":"4.1.13","status":"affected","lessThan":"4.1.13","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"EFG","defaultStatus":"unaffected","versions":[{"version":"4.1.13","status":"affected","lessThan":"4.1.13","versionType":"semver"}]}],"references":["https://community.ui.com/releases/Security-Advisory-Bulletin-045-045/6011bc61-f2eb-457f-b71d-755703817aaf"],"weaknesses":["CWE-295"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/23xxx/CVE-2025-23091.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-23091","state":"PUBLISHED","datePublished":"2025-02-01T06:53:09.114Z","dateUpdated":"2025-03-13T12:54:46.381Z","assignerShortName":"hackerone","assignerOrgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","dateReserved":"2025-01-10T19:05:52.772Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM) attack during application update."}],"affected":[{"vendor":"Ubiquiti Inc","product":"UDM","defaultStatus":"unaffected","versions":[{"version":"4.1.13","status":"affected","lessThan":"4.1.13","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UDM-Pro","defaultStatus":"unaffected","versions":[{"version":"4.1.13","status":"affected","lessThan":"4.1.13","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UDM-SE","defaultStatus":"unaffected","versions":[{"version":"4.1.13","status":"affected","lessThan":"4.1.13","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UDM-Pro-Max","defaultStatus":"unaffected","versions":[{"version":"4.1.13","status":"affected","lessThan":"4.1.13","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UDW","defaultStatus":"unaffected","versions":[{"version":"4.1.13","status":"affected","lessThan":"4.1.13","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UNVR","defaultStatus":"unaffected","versions":[{"version":"4.1.11","status":"affected","lessThan":"4.1.11","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UNVR PRO","defaultStatus":"unaffected","versions":[{"version":"4.1.11","status":"affected","lessThan":"4.1.11","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UCKP","defaultStatus":"unaffected","versions":[{"version":"4.1.11","status":"affected","lessThan":"4.1.11","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UCK","defaultStatus":"unaffected","versions":[{"version":"4.1.11","status":"affected","lessThan":"4.1.11","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UCK-Enterprise","defaultStatus":"unaffected","versions":[{"version":"4.1.11","status":"affected","lessThan":"4.1.11","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"UCG-Max","defaultStatus":"unaffected","versions":[{"version":"4.1.13","status":"affected","lessThan":"4.1.13","versionType":"semver"}]},{"vendor":"Ubiquiti Inc","product":"EFG","defaultStatus":"unaffected","versions":[{"version":"4.1.13","status":"affected","lessThan":"4.1.13","versionType":"semver"}]}],"references":[{"url":"https://community.ui.com/releases/Security-Advisory-Bulletin-045-045/6011bc61-f2eb-457f-b71d-755703817aaf"}],"metrics":[{"cvssV3_0":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM"}}],"providerMetadata":{"shortName":"hackerone","orgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","dateUpdated":"2025-02-01T06:53:09.114Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-03T15:47:37.586798Z","id":"CVE-2025-23091","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-295","type":"CWE","lang":"en","description":"CWE-295 Improper Certificate Validation"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-13T12:54:46.381Z"}}]}}}