CVE-2019-25652: UniFi Network Controller MITM Vulnerability

CVE-2019-25652 Overview

CVE-2019-25652 is an improper certificate validation vulnerability affecting UniFi Network Controller versions before 5.10.22 and 5.11.x versions before 5.11.18. The vulnerability stems from inadequate SSL certificate verification during SMTP connections, enabling adjacent network attackers to perform man-in-the-middle (MitM) attacks. By presenting a fraudulent SSL certificate, attackers can intercept SMTP traffic and potentially obtain sensitive credentials transmitted through the insecure channel.

Critical Impact

Adjacent network attackers can intercept SMTP credentials by exploiting weak SSL certificate validation, potentially compromising email communications and associated account credentials.

Affected Products

• UniFi Network Controller versions before 5.10.22
• UniFi Network Controller 5.11.x versions before 5.11.18

Discovery Timeline

• 2026-03-27 - CVE CVE-2019-25652 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2019-25652

Vulnerability Analysis

This vulnerability is classified under CWE-295 (Improper Certificate Validation). The UniFi Network Controller fails to properly verify SSL/TLS certificates when establishing SMTP connections. This cryptographic weakness allows attackers positioned on the adjacent network to intercept and manipulate SMTP communications by presenting malicious certificates that the controller erroneously trusts.

The attack requires the adversary to be on the adjacent network segment, which increases the complexity of exploitation but remains feasible in enterprise environments where network segmentation may be incomplete. Once positioned, the attacker can capture SMTP credentials as they are transmitted, potentially gaining access to email accounts and any services that share those credentials.

Root Cause

The root cause lies in the SMTP certificate validation mechanism within the UniFi Network Controller. The software does not properly verify the authenticity of SSL certificates presented during SMTP handshakes, accepting certificates without adequate verification of the certificate chain, hostname matching, or certificate validity. This oversight in the cryptographic implementation creates a window for certificate spoofing attacks.

Attack Vector

The attack requires adjacent network access, meaning the attacker must be positioned on the same local network segment as the target UniFi Network Controller. From this position, the attacker performs a man-in-the-middle attack by:

1. Intercepting SMTP connection attempts from the UniFi Network Controller
2. Presenting a fraudulent SSL certificate to the controller
3. Establishing separate encrypted connections with both the controller and the legitimate SMTP server
4. Capturing credentials and email content as traffic passes through the attacker's system

The vulnerability exploits the lack of proper certificate hostname verification and chain validation, allowing self-signed or attacker-controlled certificates to be accepted as legitimate.

Detection Methods for CVE-2019-25652

Indicators of Compromise

• Unexpected SSL certificate warnings or errors in network traffic logs related to SMTP connections
• Unauthorized SMTP relay activity originating from the UniFi Network Controller's network segment
• ARP spoofing indicators or unusual MAC address behavior on the local network
• Anomalous SSL/TLS handshake patterns in network capture data

Detection Strategies

• Monitor SMTP traffic for certificate validation failures or mismatched certificate details
• Implement network-based intrusion detection systems (IDS) to identify potential MitM attack patterns
• Deploy SentinelOne Singularity Platform to detect suspicious network behaviors and credential theft attempts
• Review UniFi Network Controller logs for SMTP connection anomalies or authentication failures

Monitoring Recommendations

• Enable detailed logging for all SMTP connections from the UniFi Network Controller
• Implement certificate pinning monitoring to detect when unexpected certificates are presented
• Use network traffic analysis tools to baseline normal SMTP communication patterns
• Configure alerts for any changes in SMTP server certificate fingerprints

How to Mitigate CVE-2019-25652

Immediate Actions Required

• Upgrade UniFi Network Controller to version 5.10.22 or later for the 5.10.x branch
• Upgrade UniFi Network Controller to version 5.11.18 or later for the 5.11.x branch
• Audit SMTP credentials that may have been exposed and rotate them immediately
• Implement network segmentation to isolate the UniFi Network Controller from untrusted adjacent devices

Patch Information

Ubiquiti has addressed this vulnerability in UniFi Network Controller versions 5.10.22 and 5.11.18. Administrators should upgrade to these patched versions or later releases to remediate the improper certificate validation issue. For detailed patch information, refer to the Community UI Security Advisory.

Workarounds

• Disable SMTP email notifications temporarily until the patch can be applied
• Use a local SMTP relay on the same trusted network segment to reduce exposure
• Implement strict network access controls to limit adjacent network access
• Deploy network monitoring to detect potential MitM attacks during the interim period

# Verify UniFi Network Controller version
# Access the controller via SSH or check Settings > System
# Ensure version is 5.10.22+ or 5.11.18+
dpkg -l | grep unifi
# Expected output should show version >= 5.10.22 or >= 5.11.18