CVE-2025-27212
Last modified
CVE-2025-27212 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network. Affected Products: UniFi Access Reader Pro (Version 2.14.21 and earlier) UniFi Access G2 Reader Pro (Version 1.10.32 and earlier) UniFi Access G3 Reader Pro (Version 1.10.30 and earlier) UniFi Access Intercom (Version 1.7.28 and earlier) UniFi Access G3 Intercom (Version 1.7.29 and earlier) UniFi Access Intercom Viewer (Version 1.3.20 and earlier) Mitigation: Update UniFi Access Reader Pro Version 2.15.9 or later Update UniFi Access G2 Reader Pro Version 1.11.23 or later Update UniFi Access G3 Reader Pro Version 1.11.22 or later Update UniFi Access Intercom Version 1.8.22 or later Update UniFi Access G3 Intercom Version 1.8.22 or later Update UniFi Access Intercom Viewer Version 1.4.39 or later. EPSS estimates a 1.19% chance of exploitation in the next 30 days.
Description
An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network. Affected Products: UniFi Access Reader Pro (Version 2.14.21 and earlier) UniFi Access G2 Reader Pro (Version 1.10.32 and earlier) UniFi Access G3 Reader Pro (Version 1.10.30 and earlier) UniFi Access Intercom (Version 1.7.28 and earlier) UniFi Access G3 Intercom (Version 1.7.29 and earlier) UniFi Access Intercom Viewer (Version 1.3.20 and earlier) Mitigation: Update UniFi Access Reader Pro Version 2.15.9 or later Update UniFi Access G2 Reader Pro Version 1.11.23 or later Update UniFi Access G3 Reader Pro Version 1.11.22 or later Update UniFi Access Intercom Version 1.8.22 or later Update UniFi Access G3 Intercom Version 1.8.22 or later Update UniFi Access Intercom Viewer Version 1.4.39 or later
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-27212?
How severe is CVE-2025-27212?
How do I fix CVE-2025-27212?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-27207Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p1…6.5
- CVE-2025-27208A reflected Cross-Site Scripting (XSS) vulnerability has bee…6.1
- CVE-2025-27209The V8 release used in Node.js v24.0.0 has changed how strin…7.5
- CVE-2025-2721Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2025-27210An incomplete fix has been identified for CVE-2025-23084 in …7.5
- CVE-2025-27211An Improper Input Validation in EdgeMAX EdgeSwitch (Version …7.5
- CVE-2025-27213An Improper Access Control could allow a malicious actor aut…4.9
- CVE-2025-27214A Missing Authentication for Critical Function vulnerability…9.8
- CVE-2025-27215An Improper Access Control could allow a malicious actor aut…8.1
- CVE-2025-27216Multiple Incorrect Permission Assignment for Critical Resour…8.8
- CVE-2025-27217A Server-Side Request Forgery (SSRF) in the UISP Application…9.1
- CVE-2025-27218Sitecore Experience Manager (XM) and Experience Platform (XP…5.3
Are you affected by CVE-2025-27212?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST