The SentinelOne Annual Threat Report - A Defenders Guide from the FrontlinesThe SentinelOne Annual Threat ReportGet the Report
Experiencing a Breach?Blog
Get StartedContact Us
SentinelOne
  • Platform
    Platform Overview
    • Singularity Platform
      Welcome to Integrated Enterprise Security
    • AI for Security
      Leading the Way in AI-Powered Security Solutions
    • Securing AI
      Accelerate AI Adoption with Secure AI Tools, Apps, and Agents.
    • How It Works
      The Singularity XDR Difference
    • Singularity Marketplace
      One-Click Integrations to Unlock the Power of XDR
    • Pricing & Packaging
      Comparisons and Guidance at a Glance
    Data & AI
    • Purple AI
      Accelerate SecOps with Generative AI
    • Singularity Hyperautomation
      Easily Automate Security Processes
    • AI-SIEM
      The AI SIEM for the Autonomous SOC
    • AI Data Pipelines
      Security Data Pipeline for AI SIEM and Data Optimization
    • Singularity Data Lake
      AI-Powered, Unified Data Lake
    • Singularity Data Lake for Log Analytics
      Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
    Endpoint Security
    • Singularity Endpoint
      Autonomous Prevention, Detection, and Response
    • Singularity XDR
      Native & Open Protection, Detection, and Response
    • Singularity RemoteOps Forensics
      Orchestrate Forensics at Scale
    • Singularity Threat Intelligence
      Comprehensive Adversary Intelligence
    • Singularity Vulnerability Management
      Application & OS Vulnerability Management
    • Singularity Identity
      Identity Threat Detection and Response
    Cloud Security
    • Singularity Cloud Security
      Block Attacks with an AI-Powered CNAPP
    • Singularity Cloud Native Security
      Secure Cloud and Development Resources
    • Singularity Cloud Workload Security
      Real-Time Cloud Workload Protection Platform
    • Singularity Cloud Data Security
      AI-Powered Threat Detection for Cloud Storage
    • Singularity Cloud Security Posture Management
      Detect and Remediate Cloud Misconfigurations
    Securing AI
    • Prompt Security
      Secure AI Tools Across Your Enterprise
  • Why SentinelOne?
    Why SentinelOne?
    • Why SentinelOne?
      Cybersecurity Built for What’s Next
    • Our Customers
      Trusted by the World’s Leading Enterprises
    • Industry Recognition
      Tested and Proven by the Experts
    • About Us
      The Industry Leader in Autonomous Cybersecurity
    Compare SentinelOne
    • Arctic Wolf
    • Broadcom
    • CrowdStrike
    • Cybereason
    • Microsoft
    • Palo Alto Networks
    • Sophos
    • Splunk
    • Trellix
    • Trend Micro
    • Wiz
    Verticals
    • Energy
    • Federal Government
    • Finance
    • Healthcare
    • Higher Education
    • K-12 Education
    • Manufacturing
    • Retail
    • State and Local Government
  • Services
    Managed Services
    • Managed Services Overview
      Wayfinder Threat Detection & Response
    • Threat Hunting
      World-Class Expertise and Threat Intelligence
    • Managed Detection & Response
      24/7/365 Expert MDR Across Your Entire Environment
    • Incident Readiness & Response
      DFIR, Breach Readiness, & Compromise Assessments
    Support, Deployment, & Health
    • Technical Account Management
      Customer Success with Personalized Service
    • SentinelOne GO
      Guided Onboarding & Deployment Advisory
    • SentinelOne University
      Live and On-Demand Training
    • Services Overview
      Comprehensive Solutions for Seamless Security Operations
    • SentinelOne Community
      Community Login
  • Partners
    Our Network
    • MSSP Partners
      Succeed Faster with SentinelOne
    • Singularity Marketplace
      Extend the Power of S1 Technology
    • Cyber Risk Partners
      Enlist Pro Response and Advisory Teams
    • Technology Alliances
      Integrated, Enterprise-Scale Solutions
    • SentinelOne for AWS
      Hosted in AWS Regions Around the World
    • Channel Partners
      Deliver the Right Solutions, Together
    • SentinelOne for Google Cloud
      Unified, Autonomous Security Giving Defenders the Advantage at Global Scale
    • Partner Locator
      Your Go-to Source for Our Top Partners in Your Region
    Partner Portal→
  • Resources
    Resource Center
    • Case Studies
    • Data Sheets
    • eBooks
    • Reports
    • Videos
    • Webinars
    • Whitepapers
    • Events
    View All Resources→
    Blog
    • Feature Spotlight
    • For CISO/CIO
    • From the Front Lines
    • Identity
    • Cloud
    • macOS
    • SentinelOne Blog
    Blog→
    Tech Resources
    • SentinelLABS
    • Ransomware Anthology
    • Cybersecurity 101
  • About
    About SentinelOne
    • About SentinelOne
      The Industry Leader in Cybersecurity
    • Investor Relations
      Financial Information & Events
    • SentinelLABS
      Threat Research for the Modern Threat Hunter
    • Careers
      The Latest Job Opportunities
    • Press & News
      Company Announcements
    • Cybersecurity Blog
      The Latest Cybersecurity Threats, News, & More
    • FAQ
      Get Answers to Our Most Frequently Asked Questions
    • DataSet
      The Live Data Platform
    • S Foundation
      Securing a Safer Future for All
    • S Ventures
      Investing in the Next Generation of Security, Data and AI
  • Pricing
Get StartedContact Us
CVE Vulnerability Database
Vulnerability Database/CVE-2025-24290

CVE-2025-24290: UISP Application SQLi Vulnerability

CVE-2025-24290 involves authenticated SQL injection flaws in UISP Application version 2.4.206 and earlier, enabling low-privileged users to escalate privileges. This article covers technical details, affected versions, and mitigation.

Published: April 15, 2026

CVE-2025-24290 Overview

CVE-2025-24290 identifies multiple authenticated SQL Injection vulnerabilities in the Ubiquiti UISP (Ubiquiti Internet Service Provider) application affecting version 2.4.206 and earlier. These vulnerabilities allow a malicious actor with low privileges to craft malicious SQL queries that can bypass authentication controls and escalate privileges within the application. This represents a significant security risk for organizations relying on UISP for network management and service provider operations.

Critical Impact

Authenticated attackers with minimal privileges can exploit SQL Injection flaws to escalate privileges, potentially gaining full administrative control over the UISP application and underlying database systems.

Affected Products

  • Ubiquiti UISP Application version 2.4.206 and earlier
  • UISP deployments accessible over network interfaces
  • All UISP installations running vulnerable versions without applied patches

Discovery Timeline

  • 2025-06-29 - CVE-2025-24290 published to NVD
  • 2025-06-30 - Last updated in NVD database

Technical Details for CVE-2025-24290

Vulnerability Analysis

This vulnerability falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The UISP application fails to properly sanitize user-supplied input in multiple locations, allowing authenticated users to inject arbitrary SQL commands into database queries.

What makes this vulnerability particularly dangerous is the privilege escalation vector. Even users with low-level access to the UISP application can craft malicious input that manipulates SQL queries executed by the application. This can lead to unauthorized data access, modification of database records, or complete takeover of administrative functions.

The network-based attack vector means that any authenticated user with network access to the UISP application can potentially exploit these vulnerabilities without requiring physical access or complex attack chains.

Root Cause

The root cause of CVE-2025-24290 lies in improper input validation and inadequate sanitization of user-supplied data before it is incorporated into SQL queries. The UISP application fails to implement parameterized queries or proper escaping mechanisms in multiple code paths, allowing SQL metacharacters to be interpreted as SQL commands rather than data.

When user input containing SQL syntax is processed by the vulnerable application, it is directly concatenated into SQL query strings without proper sanitization. This allows attackers to break out of the intended query context and inject additional SQL commands that execute with the privileges of the database user configured for the UISP application.

Attack Vector

The attack is network-based and requires the attacker to have valid credentials with at least low-level privileges in the UISP application. The exploitation process typically involves:

  1. Authentication to the UISP application using valid low-privilege credentials
  2. Identifying input fields or API endpoints that are vulnerable to SQL Injection
  3. Crafting malicious SQL payloads designed to escalate privileges or extract sensitive data
  4. Submitting the crafted input through the vulnerable interface
  5. Leveraging the injected SQL to modify user roles, access administrative functions, or exfiltrate data

The vulnerability allows attackers to affect resources beyond the vulnerable component's scope, meaning the impact can extend to other systems that share the same database infrastructure or trust relationships with the UISP application.

Detection Methods for CVE-2025-24290

Indicators of Compromise

  • Unusual database queries containing SQL injection patterns such as UNION SELECT, OR 1=1, or comment sequences (--, /**/)
  • Unexpected privilege changes for low-level user accounts in the UISP application
  • Database logs showing queries accessing system tables or user credential stores
  • Authentication anomalies where low-privilege users access administrative functions

Detection Strategies

  • Implement web application firewall (WAF) rules to detect and block SQL injection patterns in requests to UISP
  • Monitor UISP application logs for unusual parameter values containing SQL syntax characters
  • Deploy database activity monitoring to identify anomalous query patterns or unauthorized data access
  • Utilize SentinelOne Singularity to detect post-exploitation activities following successful SQL injection attacks

Monitoring Recommendations

  • Enable detailed logging for the UISP application and associated database systems
  • Configure alerting for failed login attempts followed by successful privilege escalations
  • Monitor network traffic to UISP for requests containing encoded SQL injection payloads
  • Review database audit logs for queries accessing sensitive tables outside normal application behavior

How to Mitigate CVE-2025-24290

Immediate Actions Required

  • Upgrade UISP application to the latest patched version immediately
  • Restrict network access to the UISP application to trusted networks only
  • Audit all user accounts and remove unnecessary low-privilege access until patching is complete
  • Enable database query logging and monitoring to detect exploitation attempts

Patch Information

Ubiquiti has released a security advisory addressing CVE-2025-24290. Organizations should consult the UI Security Advisory Bulletin 048 for detailed patching instructions and download links for the updated UISP application version that resolves these SQL Injection vulnerabilities.

Workarounds

  • Place the UISP application behind a reverse proxy with SQL injection filtering capabilities
  • Implement network segmentation to limit access to UISP management interfaces
  • Temporarily disable or restrict low-privilege user accounts until patches can be applied
  • Configure database-level restrictions to limit the scope of queries executable by the UISP application user
bash
# Example: Restrict network access to UISP management interface using iptables
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

  • Vulnerability Details
  • TypeAuth Bypass

  • Vendor/TechUisp

  • SeverityCRITICAL

  • CVSS Score9.9

  • EPSS Probability0.05%

  • Known ExploitedNo
  • CVSS Vector
  • CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • Impact Assessment
  • ConfidentialityLow
  • IntegrityNone
  • AvailabilityHigh
  • CWE References
  • CWE-89
  • Technical References
  • UI Security Advisory Bulletin 048
  • Latest CVEs
  • CVE-2025-52479: HTTP.jl & URIs.jl CRLF Injection Flaw

  • CVE-2026-31740: Linux Kernel Race Condition Vulnerability

  • CVE-2026-31743: Linux Kernel Buffer Overflow Vulnerability

  • CVE-2026-31744: Linux Kernel NULL Pointer Vulnerability
Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the World’s Most Advanced Cybersecurity Platform

See how our intelligent, autonomous cybersecurity platform can protect your organization now and into the future.

Try SentinelOne
  • Get Started
  • Get a Demo
  • Product Tour
  • Why SentinelOne
  • Pricing & Packaging
  • FAQ
  • Contact
  • Contact Us
  • Customer Support
  • SentinelOne Status
  • Language
  • Platform
  • Singularity Platform
  • Singularity Endpoint
  • Singularity Cloud
  • Singularity AI-SIEM
  • Singularity Identity
  • Singularity Marketplace
  • Purple AI
  • Services
  • Wayfinder TDR
  • SentinelOne GO
  • Technical Account Management
  • Support Services
  • Verticals
  • Energy
  • Federal Government
  • Finance
  • Healthcare
  • Higher Education
  • K-12 Education
  • Manufacturing
  • Retail
  • State and Local Government
  • Cybersecurity for SMB
  • Resources
  • Blog
  • Labs
  • Case Studies
  • Videos
  • Product Tours
  • Events
  • Cybersecurity 101
  • eBooks
  • Webinars
  • Whitepapers
  • Press
  • News
  • Ransomware Anthology
  • Company
  • About Us
  • Our Customers
  • Careers
  • Partners
  • Legal & Compliance
  • Security & Compliance
  • Investor Relations
  • S Foundation
  • S Ventures

©2026 SentinelOne, All Rights Reserved.

Privacy Notice Terms of Use

English