Critical severity · published Aug 4, 2025
CVE-2025-27212
An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network.
Affected Products:
UniFi Access Reader Pro (Version 2.14.21 and earlier)
UniFi Access G2 Reader Pro (Version 1.10.32 and earlier)
UniFi Access G3 Reader Pro (Version 1.10.30 and earlier)
UniFi Access Intercom (Version 1.7.28 and earlier)
UniFi Access G3 Intercom (Version 1.7.29 and earlier)
UniFi Access Intercom Viewer (Version 1.3.20 and earlier)
Mitigation:
Update UniFi Access Reader Pro Version 2.15.9 or later
Update UniFi Access G2 Reader Pro Version 1.11.23 or later
Update UniFi Access G3 Reader Pro Version 1.11.22 or later
Update UniFi Access Intercom Version 1.8.22 or later
Update UniFi Access G3 Intercom Version 1.8.22 or later
Update UniFi Access Intercom Viewer Version 1.4.39 or later
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UA
UniFi Access G2 Reader Pro · Ubiquiti Inc
1.11.23 before 1.11.23 · source: vendor
UA
UniFi Access G3 Intercom · Ubiquiti Inc
1.8.22 before 1.8.22 · source: vendor
UA
UniFi Access G3 Reader Pro · Ubiquiti Inc
1.11.22 before 1.11.22 · source: vendor
UA
UniFi Access Intercom · Ubiquiti Inc
1.8.22 before 1.8.22 · source: vendor
UA
UniFi Access Intercom Viewer · Ubiquiti Inc
1.4.39 before 1.4.39 · source: vendor
UA
UniFi Access Reader Pro · Ubiquiti Inc
2.15.9 before 2.15.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27212
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27212
community.ui.com
https://community.ui.com/releases/Security-Advisory-Bulletin-051-051/583fa6e1-3d85-42ec-a453-651d1653c9b3
More from UniFi Access G2 Reader Pro
2.2
CVE-2024-29206
An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the system