Login Request a demo
High severity · published Aug 21, 2025
CVE-2025-27215
An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsupported changes to the system
8.1
CVSS
0.3%
EPSS
No
On KEV
Description
An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsupported changes to the system. Affected Products: UniFi Connect Display Cast (Version 1.10.3 and earlier) UniFi Connect Display Cast Pro (Version 1.0.89 and earlier) UniFi Connect Display Cast Lite (Version 1.0.3 and earlier) Mitigation: Update UniFi Connect Display Cast to Version 1.10.7 or later Update UniFi Connect Display Cast Pro to Version 1.0.94 or later Update UniFi Connect Display Cast Lite to Version 1.1.8 or later
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UC
UniFi Connect Display Cast · Ubiquiti Inc
1.10.7 before 1.10.7 · source: vendor
UC
UniFi Connect Display Cast Lite · Ubiquiti Inc
1.1.8 before 1.1.8 · source: vendor
UC
UniFi Connect Display Cast Pro · Ubiquiti Inc
1.0.94 before 1.0.94 · source: vendor
Affected product
UC
UniFi Connect Display Cast
Ubiquiti Inc
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27215
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27215
community.ui.com
https://community.ui.com/releases/Security-Advisory-Bulletin-052-052/ac1251ee-5bb5-4cdf-8a71-68acd1775bb6
More from UniFi Connect Display Cast
7.5
CVE-2024-29207
An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system
4.9
CVE-2025-27213
An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug Bridge (ADB) and make unsupported…
2.2
CVE-2024-29206
An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the system