CVE-2025-23091
Medium
Description
An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM) attack during application update.
SeverityMedium
CVSS5.9
Exploit probability—
ProductUDM
PublishedFeb 1, 2025
First seenFeb 1, 2025
Weakness typeCWE-295CWE-295
How to fix
Update
- Ubiquiti Inc UDM4.1.13 or later
- Ubiquiti Inc UDM-Pro4.1.13 or later
- Ubiquiti Inc UDM-SE4.1.13 or later
- Ubiquiti Inc UDM-Pro-Max4.1.13 or later
- Ubiquiti Inc UDW4.1.13 or later
- Ubiquiti Inc UNVR4.1.11 or later
- Ubiquiti Inc UNVR PRO4.1.11 or later
- Ubiquiti Inc UCKP4.1.11 or later
- Ubiquiti Inc UCK4.1.11 or later
- Ubiquiti Inc UCK-Enterprise4.1.11 or later
- Ubiquiti Inc UCG-Max4.1.13 or later
- Ubiquiti Inc EFG4.1.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Ubiquiti Inc UDM | 4.1.13 | 4.1.13 |
| Ubiquiti Inc UDM-Pro | 4.1.13 | 4.1.13 |
| Ubiquiti Inc UDM-SE | 4.1.13 | 4.1.13 |
| Ubiquiti Inc UDM-Pro-Max | 4.1.13 | 4.1.13 |
| Ubiquiti Inc UDW | 4.1.13 | 4.1.13 |
| Ubiquiti Inc UNVR | 4.1.11 | 4.1.11 |
| Ubiquiti Inc UNVR PRO | 4.1.11 | 4.1.11 |
| Ubiquiti Inc UCKP | 4.1.11 | 4.1.11 |
| Ubiquiti Inc UCK | 4.1.11 | 4.1.11 |
| Ubiquiti Inc UCK-Enterprise | 4.1.11 | 4.1.11 |
| Ubiquiti Inc UCG-Max | 4.1.13 | 4.1.13 |
| Ubiquiti Inc EFG | 4.1.13 | 4.1.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.