CVE-2025-12636: Ubia Ubox

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-06 · updated 2026-10-18
Weakness: CWE-522

Description

The Ubia camera ecosystem fails to adequately secure API credentials, potentially enabling an attacker to connect to backend services. The attacker would then be able to gain unauthorized access to available cameras, enabling the viewing of live feeds or modification of settings.

Affected products

Ubia Ubox Android: before January 15, 2026 — fixed in 2026, January 15
Ubia Ubox IOS: before January 15, 2026 — fixed in 2026, January 15

How to fix

Upgrade to a fixed version: Ubia Ubox Android 2026, January 15; Ubia Ubox IOS 2026, January 15. Check the vendor advisory for mitigations.

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-310-02.json
https://www.cisa.gov/news-events/ics-advisories/icsa-25-310-02

Get alerted when CVE-2025-12636 or the next vulnerability affects your stack