Ubiquiti UniFi Device Vulnerability Enables Remote Command Injection by Attackers

Ubiquiti Networks has disclosed a critical security vulnerability affecting multiple UniFi Access devices that could enable malicious actors to execute arbitrary commands through improper input validation.

The vulnerability, assigned CVE-2025-27212 and discovered by security researchers Bongeun Koo and Junhyung Cho, carries a maximum CVSS score of 9.8, indicating severe potential for exploitation.

The vulnerability specifically targets the management network infrastructure of UniFi Access systems, potentially compromising the security of enterprise access control deployments worldwide.

The vulnerability stems from improper input validation mechanisms within UniFi Access devices, creating an attack vector that allows command injection by malicious actors who gain access to the UniFi Access management network.

This type of vulnerability is particularly concerning for enterprise environments where UniFi Access systems control physical security infrastructure, including door locks, intercoms, and access control points throughout corporate facilities.

The technical nature of this vulnerability means that attackers with network access to the management interface can potentially execute arbitrary system commands, leading to complete system compromise.

The attack vector requires network access (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), making it relatively straightforward for attackers to exploit once they gain access to the management network.

The vulnerability affects the confidentiality, integrity, and availability of the targeted systems at the highest level, as indicated by the C:H/I:H/A:H metrics in the CVSS scoring.

Security researchers Bongeun Koo (@kiddo_pwn) and Junhyung Cho (@da2Rim) are credited with discovering this vulnerability, highlighting the importance of responsible disclosure in the cybersecurity community.

Their research has enabled Ubiquiti to develop and release patches before widespread exploitation could occur, demonstrating the critical role that security researchers play in maintaining the security of enterprise infrastructure.

Ubiquiti UniFi Device Vulnerability

The vulnerability impacts six distinct UniFi Access product lines, spanning multiple generations of hardware. The affected devices include:

Reader Systems:

• UniFi Access Reader Pro (version 2.14.21 and earlier).
• UniFi Access G2 Reader Pro (version 1.10.32 and earlier).
• UniFi Access G3 Reader Pro (version 1.10.30 and earlier).

Intercom Systems:

• UniFi Access Intercom (version 1.7.28 and earlier).
• UniFi Access G3 Intercom (version 1.7.29 and earlier).
• UniFi Access Intercom Viewer (version 1.3.20 and earlier).

This widespread impact across both reader and intercom product lines suggests that the vulnerability exists in shared code components or common development frameworks used across the UniFi Access ecosystem.

The fact that multiple generations of hardware are affected, including the newer G3 series, indicates that this is a systemic issue that has persisted through several product development cycles.

The critical CVSS score of 9.8 reflects the severe potential impact of this vulnerability.

Immediate Updates

Ubiquiti has released security updates for all affected products, urging immediate installation to mitigate the risk of exploitation.

The UniFi Access Reader Pro should be updated to version 2.15.9 or later, while the UniFi Access G2 Reader Pro requires version 1.11.23 or later. The UniFi Access G3 Reader Pro needs version 1.11.22 or later to address the vulnerability.

For intercom systems, administrators should update the UniFi Access Intercom to version 1.8.22 or later, the UniFi Access G3 Intercom to version 1.8.22 or later, and the UniFi Access Intercom Viewer to version 1.4.39 or later.

These updates contain patches that address the improper input validation issues and prevent command injection attacks.

Organizations should prioritize these updates given the critical nature of the vulnerability and its potential impact on physical security systems.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.