A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later.
Affected Products:
UniFi Access Application (Version 3.3.22 through 3.4.31).
Mitigation:
Update your UniFi Access Application to Version 4.0.21 or later.
References
Configurations
No configuration.
History
31 Oct 2025, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 10.0 |
| CWE | CWE-306 |
31 Oct 2025, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-31 00:15
Updated : 2025-10-31 14:16
NVD link : CVE-2025-52665
Mitre link : CVE-2025-52665
CVE.ORG link : CVE-2025-52665
JSON object : View
Products Affected
No product.
CWE
CWE-306
Missing Authentication for Critical Function