CVE-2025-27212

Summary

An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network.

Affected Products: UniFi Access Reader Pro (Version 2.14.21 and earlier) UniFi Access G2 Reader Pro (Version 1.10.32 and earlier) UniFi Access G3 Reader Pro (Version 1.10.30 and earlier) UniFi Access Intercom (Version 1.7.28 and earlier) UniFi Access G3 Intercom (Version 1.7.29 and earlier) UniFi Access Intercom Viewer (Version 1.3.20 and earlier)

Mitigation: Update UniFi Access Reader Pro Version 2.15.9 or later Update UniFi Access G2 Reader Pro Version 1.11.23 or later Update UniFi Access G3 Reader Pro Version 1.11.22 or later Update UniFi Access Intercom Version 1.8.22 or later Update UniFi Access G3 Intercom Version 1.8.22 or later Update UniFi Access Intercom Viewer Version 1.4.39 or later

Affected Software

VendorProductVersion RangeStatus
Ubiquiti IncUniFi Access Reader Pro2.15.9 < 2.15.9affected
Ubiquiti IncUniFi Access G2 Reader Pro1.11.23 < 1.11.23affected
Ubiquiti IncUniFi Access G3 Reader Pro1.11.22 < 1.11.22affected
Ubiquiti IncUniFi Access Intercom1.8.22 < 1.8.22affected
Ubiquiti IncUniFi Access G3 Intercom1.8.22 < 1.8.22affected
Ubiquiti IncUniFi Access Intercom Viewer1.4.39 < 1.4.39affected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References