{"id":"CVE-2025-52665","aliases":["EUVD-2025-37233","GHSA-2rj5-gh6q-72fp"],"status":"published","title":"A malicious actor with access to the management network could exploit a misconfiguration in UniFi...","description":"A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later. \n \nAffected Products:\nUniFi Access Application (Version 3.3.22 through 3.4.31). \u2028 \n\nMitigation:\nUpdate your UniFi Access Application to Version 4.0.21 or later.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.41089,"percentile":0.98675,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306"],"published":"2025-10-30T23:30:28Z","modified":"2026-10-18T21:10:00Z","exploits":[{"source":"nuclei","id":"CVE-2025-52665","title":"UniFi Access - Broken Access Control","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52665.yaml"}],"products":[{"vendor":"ubiquiti inc","product":"unifi access application"},{"vendor":"ui","product":"unifi_access"}],"references":[{"url":"https://community.ui.com/releases/Security-Advisory-Bulletin-056/ce97352d-91cd-40a7-a2f4-2c73b3b30191","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52665"},{"url":"https://github.com/advisories/GHSA-2rj5-gh6q-72fp"}],"sources":{"cve":[{"id":"CVE-2025-52665","description":"A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later. \n \nAffected Products:\nUniFi Access Application (Version 3.3.22 through 3.4.31). \u2028 \n\nMitigation:\nUpdate your UniFi Access Application to Version 4.0.21 or later.","status":"published","published":"2025-10-30T23:30:28.329Z","modified":"2025-10-31T14:07:27.85Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:32:31.309974Z"}],"euvd":[{"id":"EUVD-2025-37233","description":"A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later. \n \nAffected Products:\nUniFi Access Application (Version 3.3.22 through 3.4.31). \u2028 \n\nMitigation:\nUpdate your UniFi Access Application to Version 4.0.21 or later.","status":"published","published":"2025-10-30T23:30:28Z","modified":"2025-10-31T14:07:27Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:35.368666Z"}],"ghsa":[{"id":"GHSA-2rj5-gh6q-72fp","title":"A malicious actor with access to the management network could exploit a misconfiguration in UniFi...","description":"A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later. \n \nAffected Products:\nUniFi Access Application (Version 3.3.22 through 3.4.31). \u2028 \n\nMitigation:\nUpdate your UniFi Access Application to Version 4.0.21 or later.","status":"published","published":"2025-10-31T00:30:35Z","modified":"2025-10-31T15:31:33Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:04:16.493141Z"}],"nvd":[{"id":"CVE-2025-52665","description":"A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later. \n \nAffected Products:\nUniFi Access Application (Version 3.3.22 through 3.4.31). \u2028 \n\nMitigation:\nUpdate your UniFi Access Application to Version 4.0.21 or later.","status":"published","published":"2025-10-31T00:15:37Z","modified":"2026-10-18T21:10:00.12Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:11:41.607433Z"}]}}