CVE-2025-52665: UniFi Access Auth Bypass Vulnerability

CVE-2025-52665 Overview

A critical authentication bypass vulnerability exists in Ubiquiti's UniFi Access door access application. A malicious actor with access to the management network could exploit a misconfiguration that exposed a management API without proper authentication. This vulnerability allows unauthorized access to sensitive door access control systems, potentially enabling physical security breaches and unauthorized building access.

Critical Impact

Unauthenticated attackers with management network access can fully compromise door access control systems, potentially unlocking doors, modifying access permissions, and gaining physical entry to secured areas.

Affected Products

• UniFi Access Application (Version 3.3.22 through 3.4.31)
• ui unifi_access

Discovery Timeline

• 2025-10-31 - CVE CVE-2025-52665 published to NVD
• 2025-11-12 - Last updated in NVD database

Technical Details for CVE-2025-52665

Vulnerability Analysis

This vulnerability is classified as CWE-306: Missing Authentication for Critical Function. The UniFi Access application exposed a management API endpoint without implementing proper authentication controls. This misconfiguration means that any attacker with network access to the management interface can interact with the API as if they were an authorized administrator.

The vulnerability affects the core access control functionality of the UniFi Access system, which is designed to manage physical security infrastructure including door locks, access badges, and entry permissions. Without proper authentication on the management API, the entire physical security posture of an organization using this product is compromised.

The scope of this vulnerability extends beyond the vulnerable component itself, potentially affecting connected physical access control infrastructure and building security systems.

Root Cause

The root cause of this vulnerability is a misconfiguration introduced in Version 3.3.22 that failed to enforce authentication on the management API. This represents a fundamental security design flaw where critical administrative functions were exposed without requiring proper credential verification. The missing authentication control allows any network-adjacent attacker to invoke administrative operations that should be restricted to authorized personnel only.

Attack Vector

The attack vector is network-based, requiring the attacker to have access to the management network where the UniFi Access application is deployed. The attack requires no privileges, no user interaction, and has low complexity to execute. Once an attacker gains network access to the management interface, they can directly interact with the unauthenticated API endpoints to:

1. Enumerate and modify door access permissions
2. Unlock or lock doors remotely without authorization
3. Add or remove user access credentials
4. Modify system configurations
5. Potentially disable logging or security monitoring features

The vulnerability mechanism involves direct API requests to the exposed management interface. Attackers can craft requests to administrative endpoints without providing any authentication credentials. Since the API lacks authentication enforcement, these requests are processed as legitimate administrative commands. For detailed technical information, refer to the Ubiquiti Security Advisory Bulletin 056.

Detection Methods for CVE-2025-52665

Indicators of Compromise

• Unexpected API requests to the UniFi Access management interface from unauthorized IP addresses
• Anomalous door unlock events or access permission changes in system logs
• Authentication bypass attempts or missing authentication headers in API request logs
• Unusual administrative actions performed without corresponding user sessions

Detection Strategies

• Monitor network traffic to the UniFi Access management interface for unauthenticated API requests
• Implement network segmentation detection to identify unauthorized access to management networks
• Review UniFi Access application logs for administrative actions that lack associated authenticated user sessions
• Deploy intrusion detection rules to identify exploitation attempts targeting the management API

Monitoring Recommendations

• Enable comprehensive logging on the UniFi Access application and forward logs to a SIEM solution
• Monitor for unauthorized network connections to the management interface ports
• Implement alerting for any door access control changes outside of normal business hours or maintenance windows
• Conduct regular audits of access permissions and system configurations for unauthorized modifications

How to Mitigate CVE-2025-52665

Immediate Actions Required

• Update UniFi Access Application to Version 4.0.21 or later immediately
• Isolate the UniFi Access management interface from untrusted network segments until patching is complete
• Review access logs for any indicators of unauthorized API access or configuration changes
• Audit all door access permissions and user credentials for unauthorized modifications

Patch Information

Ubiquiti has released a security patch addressing this vulnerability. Update your UniFi Access Application to Version 4.0.21 or later to remediate this issue. The patch information is available in the Ubiquiti Security Advisory Bulletin 056.

Workarounds

• Implement strict network segmentation to ensure only authorized systems can reach the UniFi Access management interface
• Deploy firewall rules to restrict management API access to known administrative IP addresses only
• Enable VPN requirements for remote management access to add an additional authentication layer
• Monitor and log all network traffic to the management interface as an interim detection measure

# Example network segmentation firewall rule (adjust IPs as needed)
# Restrict access to UniFi Access management interface
iptables -A INPUT -p tcp --dport 443 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP