{"schemaVersion":3,"id":"CVE-2025-27212","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network.\n\n\n\nAffected Products:\nUniFi Access Reader Pro (Version 2.14.21 and earlier)\nUniFi Access G2 Reader Pro (Version 1.10.32 and earlier)\nUniFi Access G3 Reader Pro (Version 1.10.30 and earlier)\nUniFi Access Intercom (Version 1.7.28 and earlier)\nUniFi Access G3 Intercom (Version 1.7.29 and earlier)\nUniFi Access Intercom Viewer (Version 1.3.20 and earlier)\n\n\n\nMitigation:\nUpdate UniFi Access Reader Pro Version 2.15.9 or later\nUpdate UniFi Access G2 Reader Pro Version 1.11.23 or later\nUpdate UniFi Access G3 Reader Pro Version 1.11.22 or later\nUpdate UniFi Access Intercom Version 1.8.22 or later\nUpdate UniFi Access G3 Intercom Version 1.8.22 or later\nUpdate UniFi Access Intercom Viewer Version 1.4.39 or later","dates":{"published":"2025-08-04T22:12:18.820Z","modified":"2025-08-05T13:33:09.184Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01205,"percentile":0.67868,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.01205},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01205,"percentile":0.67868}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01205,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01205,"percentile":0.67868}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"},{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command ('Command Injection')","description":"The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/77.html"}],"affected":[{"vendor":"ubiquiti inc","product":"unifi access g2 reader pro","name":"UniFi Access G2 Reader Pro","label":"unifi access g2 reader pro","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.11.23, < 1.11.23","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.11.23, < 1.11.23","eol":null,"hubHref":"/vendor/ubiquiti_inc/unifi_access_g2_reader_pro"},{"vendor":"ubiquiti inc","product":"unifi access g3 intercom","name":"UniFi Access G3 Intercom","label":"unifi access g3 intercom","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.8.22, < 1.8.22","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.8.22, < 1.8.22","eol":null,"hubHref":"/vendor/ubiquiti_inc/unifi_access_g3_intercom"},{"vendor":"ubiquiti inc","product":"unifi access g3 reader pro","name":"UniFi Access G3 Reader Pro","label":"unifi access g3 reader pro","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.11.22, < 1.11.22","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.11.22, < 1.11.22","eol":null,"hubHref":"/vendor/ubiquiti_inc/unifi_access_g3_reader_pro"},{"vendor":"ubiquiti inc","product":"unifi access intercom","name":"UniFi Access Intercom","label":"unifi access intercom","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.8.22, < 1.8.22","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.8.22, < 1.8.22","eol":null,"hubHref":"/vendor/ubiquiti_inc/unifi_access_intercom"},{"vendor":"ubiquiti inc","product":"unifi access intercom viewer","name":"UniFi Access Intercom Viewer","label":"unifi access intercom viewer","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.4.39, < 1.4.39","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.4.39, < 1.4.39","eol":null,"hubHref":"/vendor/ubiquiti_inc/unifi_access_intercom_viewer"},{"vendor":"ubiquiti inc","product":"unifi access reader pro","name":"UniFi Access Reader Pro","label":"unifi access reader pro","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.15.9, < 2.15.9","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.15.9, < 2.15.9","eol":null,"hubHref":"/vendor/ubiquiti_inc/unifi_access_reader_pro"}],"affectedCount":6,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://community.ui.com/releases/Security-Advisory-Bulletin-051-051/583fa6e1-3d85-42ec-a453-651d1653c9b3","label":"community.ui.com/releases/Security-Advisory-Bulletin-051-051/583fa6e1-3d85-42ec-a453-651d1653c9b3","hostname":"community.ui.com","tags":[]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2025-08-04T22:12:18.820Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-08-05T13:33:09.184Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T19:15:14.975Z","stale":false,"partial":false}}