CVE-2019-25651
Published: Mar 27, 2026
Modified: May 25, 2026
CVSS v3.1
8.3
Description
Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 uses AES-CBC encryption for device-to-controller communication, which contains cryptographic weaknesses that allow attackers to recover encryption keys from captured traffic. Attackers with adjacent network access can capture sufficient encrypted traffic and exploit AES-CBC mode vulnerabilities to derive the encryption keys, enabling unauthorized control and management of network devices.
| Vendor | Product | Versions |
|---|---|---|
Ubiquiti | UniFi Network Controller | affected 0 - < 5.6.42affected 5.6.43 - < 5.10.12 |
Ubiquiti | UniFi UAP Firmware | affected 0 - < 4.0.6 |
Ubiquiti | UniFi UAP-AC Firmware | affected 0 - < 3.8.17 |
Ubiquiti | UniFi USW Firmware | affected 0 - < 4.0.6 |
Ubiquiti | UniFi USG Firmware | affected 0 - < 4.4.34 |
Weaknesses (CWE)
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now