CVE-2025-52665

CriticalCVSS 10.0/10Last modified Oct 18, 2026

Description

A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later. Affected Products: UniFi Access Application (Version 3.3.22 through 3.4.31).  

Mitigation: Update your UniFi Access Application to Version 4.0.21 or later.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Oct 31, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-526662.7Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator CVE-2025-526675.4Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possib CVE-2025-526685.4Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential i CVE-2025-526694.3Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to hav CVE-2025-52675.4A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerab CVE-2025-526706.5Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by ot CVE-2025-526714.3Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to a CVE-2025-52688.1Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence o CVE-2025-526872.4Successful exploitation of the vulnerability could allow an attacker with administrator credentials for the access point to inject malicious CVE-2025-526889.8Successful exploitation of the vulnerability could allow an attacker to inject commands with root privileges on the access point, potentiall CVE-2025-526899.8Successful exploitation of the vulnerability could allow an unauthenticated attacker to obtain a valid session ID with administrator privile CVE-2025-52698.1Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that w