Ubiquiti UniFi Devices Vulnerability Allows Attackers to Inject Malicious Commands

A critical security vulnerability affecting multiple Ubiquiti UniFi Access devices could allow attackers to execute malicious commands remotely. 

The vulnerability, tracked as CVE-2025-27212, stems from improper input validation and has been assigned a maximum CVSS v3.0 base score of 9.8, indicating a Critical Severity. 

Key Takeaways
1. Critical flaw (CVE-2025-27212) allows attackers to inject commands into UniFi Access devices.
2. Six device lines are affected, compromising physical security systems if exploited.
3. Immediate firmware updates and network isolation are required.

Security researchers Bongeun Koo and Junhyung Cho discovered the flaw, which affects six different UniFi Access product lines and poses significant risks to enterprise security infrastructure.

Ubiquiti UniFi Devices Injection Vulnerability

The security flaw represents a command injection vulnerability that exploits improper input validation mechanisms within the UniFi Access management network. 

According to the official Security advisory, the vulnerability allows malicious actors who have gained access to the UniFi Access management network to inject and execute arbitrary commands on affected devices.

The attack vector is particularly concerning as it requires network access (AV:N) with low attack complexity (AC:L) and no privileges required (PR:N), making it highly exploitable.

The CVSS v3.0 vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates that successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected systems. 

This classification places the vulnerability in the most severe category, requiring immediate attention from network administrators and security teams.

Affected Products 

The vulnerability impacts six distinct UniFi Access product lines with specific firmware versions. UniFi Access Reader Pro devices running version 2.14.21 and earlier are affected, along with UniFi Access G2 Reader Pro (version 1.10.32 and earlier) and UniFi Access G3 Reader Pro (version 1.10.30 and earlier). 

Additionally, intercom systems including UniFi Access Intercom (version 1.7.28 and earlier), UniFi Access G3 Intercom (version 1.7.29 and earlier), and UniFi Access Intercom Viewer (version 1.3.20 and earlier) are vulnerable.

Organizations using these devices in their physical security infrastructure face potential unauthorized access to building management systems, surveillance networks, and access control mechanisms. 

The broad scope of affected products suggests that numerous enterprise environments may be at risk. Ubiquiti has released firmware updates to address the vulnerability across all affected product lines. 

Network administrators should immediately update UniFi Access Reader Pro to version 2.15.9 or later, UniFi Access G2 Reader Pro to version 1.11.23 or later, and UniFi Access G3 Reader Pro to version 1.11.22 or later. 

For intercom systems, updates include UniFi Access Intercom and UniFi Access G3 Intercom to version 1.8.22 or later, and UniFi Access Intercom Viewer to version 1.4.39 or later.

Organizations should prioritize these updates, given the critical nature of the vulnerability, and implement network segmentation to limit exposure of UniFi Access management networks until patches are applied.

Boost detection, reduce alert fatigue, accelerate response; all with an interactive sandbox built for security teams -> Try ANY.RUN Now