PT-2026-28262 · Ubiquiti · Unifi Network Controller+4

CVE-2019-25651 · Publicado 2026-03-27 · Atualizado 2026-03-27

NVD

CVSS v3.1

8.3

Alta

Vetor base

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 uses AES-CBC encryption for device-to-controller communication, which contains cryptographic weaknesses that allow attackers to recover encryption keys from captured traffic. Attackers with adjacent network access can capture sufficient encrypted traffic and exploit AES-CBC mode vulnerabilities to derive the encryption keys, enabling unauthorized control and management of network devices.

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

Identificadores relacionados

CVE-2019-25651

Produtos afetados

Unifi Network Controller

Unifi Uap Firmware

Unifi Uap-Ac Firmware

Unifi Usg Firmware

Unifi Usw Firmware

Referências · 3

• https://vulncheck.com/advisories/ubiquiti-unifi-devices-use-of-aes-cbc-allows-key-recovery-and-unauthorized-device-control · Nota
• https://community.ui.com/releases/Security-Advisory-Bulletin-004-004/462e561b-9efd-4c23-bfa7-53d59cc64ecb · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-25651 · Nota de Segurança