What’s Vulnerable › Vulnerabilities

CVE-2019-25652: UniFi Network Controller Improper Certificate Validation Leading to Credential Theft via MITM

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-27 · updated 2026-06-17
• Weakness: CWE-295

Description

UniFi Network Controller before version 5.10.22 and 5.11.x before 5.11.18 contains an improper certificate verification vulnerability that allows adjacent network attackers to conduct man-in-the-middle attacks by presenting a false SSL certificate during SMTP connections. Attackers can intercept SMTP traffic and obtain credentials by exploiting the insecure SSL host verification mechanism in the SMTP certificate validation process.

Affected products

• Ubiquiti UniFi Network Controller: before 5.6.42; from 5.6.43 before 5.10.22; from 5.11 before 5.11.18 — fixed in 5.10.22, 5.11.18, 5.6.42

How to fix

Upgrade to a fixed version: Ubiquiti UniFi Network Controller 5.10.22, 5.11.18, 5.6.42. Check the vendor advisory for mitigations.

References

• https://community.ui.com/releases/Security-Advisory-Bulletin-003-003/982bbaa8-2a07-4f81-a5f6-0bb84753f391
• https://www.vulncheck.com/advisories/unifi-network-controller-improper-certificate-validation-leading-to-credential-theft-via-mitm

Get alerted when CVE-2019-25652 or the next vulnerability affects your stack