Medium severity · published Aug 21, 2025
CVE-2025-27213
An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug Bridge (ADB) and make unsupported…
4.9
CVSS
0.2%
EPSS
No
On KEV
Description
An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug Bridge (ADB) and make unsupported changes to the system.
Affected Products:
UniFi Connect EV Station Pro (Version 1.5.18 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.9.301 and earlier)
UniFi Connect Display Cast Pro (Version 1.0.78 and earlier)
UniFi Connect Display Cast Lite (Version 1.0.3 and earlier)
Mitigation:
Update UniFi Connect EV Station Pro to Version 1.5.27 or later
Update UniFi Connect Display to Version 1.13.6 or later
Update UniFi Connect Display Cast to Version 1.10.3 or later
Update UniFi Connect Display Cast Pro to Version 1.0.83 or later
Update UniFi Connect Display Cast Lite to Version 1.1.3 or later
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UC
UniFi Connect Display · Ubiquiti Inc
1.13.6 before 1.13.6 · source: vendor
UC
UniFi Connect Display Cast · Ubiquiti Inc
1.10.3 before 1.10.3 · source: vendor
UC
UniFi Connect Display Cast Lite · Ubiquiti Inc
1.1.3 before 1.1.3 · source: vendor
UC
UniFi Connect Display Cast Pro · Ubiquiti Inc
1.0.83 before 1.0.83 · source: vendor
UC
UniFi Connect EV Station Pro · Ubiquiti Inc
1.5.27 before 1.5.27 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27213
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27213
community.ui.com
https://community.ui.com/releases/Security-Advisory-Bulletin-052-052/ac1251ee-5bb5-4cdf-8a71-68acd1775bb6
More from UniFi Connect Display
7.5
CVE-2024-29207
An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system
2.2
CVE-2024-29206
An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the system
