CVE-2025-52663: UniFi Talk Information Disclosure Flaw

CVE-2025-52663 Overview

CVE-2025-52663 is a high-severity vulnerability affecting Ubiquiti UniFi Talk devices. Internal debugging functionality remained unintentionally enabled in production firmware. An attacker with access to the UniFi Talk management network can invoke internal debug operations through the device API.

The issue is classified under [CWE-489] Active Debug Code. Successful exploitation requires network access to the management plane but does not require authentication or user interaction. The flaw impacts confidentiality, integrity, and availability of the affected UniFi Talk endpoints.

Critical Impact
Unauthenticated attackers on the UniFi Talk management network can invoke internal debug operations on UniFi Talk Touch, Talk Touch Max, and Talk G3 phones, leading to information disclosure and device manipulation.

Affected Products

UniFi Talk Touch (Version 1.21.16 and earlier)
UniFi Talk Touch Max (Version 2.21.22 and earlier)
UniFi Talk G3 Phones (Version 3.21.26 and earlier)

Discovery Timeline

2025-10-31 - CVE-2025-52663 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-52663

Vulnerability Analysis

The vulnerability stems from internal debug code that shipped enabled in production firmware for UniFi Talk devices. Debug interfaces are typically used during development to inspect device state, manipulate runtime parameters, or trigger maintenance routines. When such interfaces remain active in released builds, they expand the attack surface beyond what is documented or expected.

In this case, the debug functionality is reachable through the device API on the UniFi Talk management network. An attacker on that network segment can issue API calls that invoke debug operations without authenticating. The Common Weakness Enumeration entry [CWE-489] specifically covers this class of issue, where development-time aids are left active in production.

The vulnerability impacts three product lines: the UniFi Talk Touch desk phone, the larger Talk Touch Max, and the G3 phone series. Because the affected interface sits at the API layer, exploitation does not require physical access or firmware modification.

Root Cause

The root cause is a configuration and build hygiene failure. Internal debugging endpoints intended for engineering use were not disabled before the affected firmware versions shipped. The device API exposes these endpoints to any caller that can reach the management network.

Attack Vector

Exploitation requires network access to the UniFi Talk management network. From there, an attacker sends crafted API requests to the affected device to invoke debug operations. No credentials and no user interaction on the device are required. Ubiquiti has not published exploitation details, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.055%.

See the Ubiquiti Security Advisory Bulletin 055 for vendor-supplied technical details.

Detection Methods for CVE-2025-52663

Indicators of Compromise

Unexpected API requests targeting debug or diagnostic endpoints on UniFi Talk Touch, Talk Touch Max, or Talk G3 phones.
Anomalous configuration changes, restarts, or log entries on UniFi Talk devices that do not correlate with administrator activity.
Outbound traffic from UniFi Talk endpoints to unrecognized destinations following management network access events.

Detection Strategies

Inventory all UniFi Talk Touch, Talk Touch Max, and Talk G3 devices and compare firmware versions against the fixed releases.
Capture and review HTTP/API traffic to UniFi Talk devices on the management VLAN, focusing on non-standard paths and parameters.
Correlate phone-side syslog or UniFi controller events with network telemetry to identify unauthorized administrative actions.

Monitoring Recommendations

Restrict and monitor access to the UniFi Talk management VLAN, alerting on new or unexpected source IP addresses.
Track firmware versions over time and alert when devices remain on vulnerable releases after the patch window closes.
Forward UniFi controller and device logs to a centralized SIEM for retention and correlation with network flow data.

How to Mitigate CVE-2025-52663

Immediate Actions Required

Upgrade UniFi Talk Touch to Version 1.21.17 or later.
Upgrade UniFi Talk Touch Max to Version 2.21.23 or later.
Upgrade UniFi Talk G3 Phones to Version 3.21.27 or later.
Audit who has access to the UniFi Talk management network and remove any unnecessary connectivity.

Patch Information

Ubiquiti published fixed firmware for each affected product line. Apply Version 1.21.17 or later for UniFi Talk Touch, Version 2.21.23 or later for UniFi Talk Touch Max, and Version 3.21.27 or later for UniFi Talk G3 Phones. Patches and details are available in Ubiquiti Security Advisory Bulletin 055.

Workarounds

Segment UniFi Talk devices onto an isolated management VLAN with strict access control lists.
Block API access to UniFi Talk devices from any host that does not require administrative connectivity.
Monitor management network traffic for unauthorized API calls until patched firmware is fully deployed.

bash

# Example: restrict UniFi Talk management VLAN with iptables on an upstream gateway
iptables -A FORWARD -s 10.10.50.0/24 -d 10.10.99.0/24 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.10.99.0/24 -j DROP