PT-2025-30007 · Ubiquiti · Unifi Access+1

Published 2025-07-18 · Updated 2025-08-04 · CVE-2025-27212

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UniFi Access Reader Pro versions 2.14.21 and earlier UniFi Access G2 Reader Pro versions 1.10.32 and earlier UniFi Access G3 Reader Pro versions 1.10.30 and earlier UniFi Access Intercom versions 1.7.28 and earlier UniFi Access G3 Intercom versions 1.7.29 and earlier UniFi Access Intercom Viewer versions 1.3.20 and earlier

Description An improper input validation in certain UniFi Access devices could allow a command injection by a malicious actor with access to the UniFi Access management network. This vulnerability allows for remote code execution (RCE).

Recommendations Update UniFi Access Reader Pro to version 2.15.9 or later. Update UniFi Access G2 Reader Pro to version 1.11.23 or later. Update UniFi Access G3 Reader Pro to version 1.11.22 or later. Update UniFi Access Intercom to version 1.8.22 or later. Update UniFi Access G3 Intercom to version 1.8.22 or later. Update UniFi Access Intercom Viewer to version 1.4.39 or later.

Fix

RCE

Command Injection

Weakness Enumeration

CWE-20

CWE-77

Related Identifiers

CVE-2025-27212

Affected Products

Doorcam

Unifi Access

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-27212 · Security Note
• https://t.me/cveNotify/130855 · Telegram Post
• https://twitter.com/dailytechonx/status/1946310256172446151 · Twitter Post
• https://twitter.com/kiddo_pwn/status/1946021184824639970 · Twitter Post
• https://community.ui.com/releases/Security-Advisory-Bulletin-051-051/583fa6e1-3d85-42ec-a453-651d1653c9b3 · Note
• https://twitter.com/CVEnew/status/1952500632578875781 · Twitter Post