CVE-2025-23116

An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor with access to UniFi…

Critical · published March 1, 2025

CVSS v3.0
9.6
EPSS
1%
Percentile
42.8
In the wild
Unconfirmed
What it is

🚨 An Authentication Bypass flaw lets nearby attackers take full control of your UniFi Protect Cameras — no password required! 🔥 Think of it like someone casually walking into a house and flipping the lights on and off, completely disregarding your wishes — unsettling, right? That's precisely how this vulnerability works, allowing unauthorized access if an attacker is on the adjacent network. The consequences could be absolutely devastating. An attacker could not only spy on your surroundings but also manipulate camera feeds and settings, potentially leading to privacy violations or even property theft. Your security could be turned against you in an instant!

Put simply

Think of it like someone casually walking into a house and flipping the lights on and off, completely disregarding your wishes — unsettling, right? That's precisely how this vulnerability works, allowing unauthorized access if an attacker is on the adjacent network. This vulnerability allows unauthorized users on the same network as the UniFi Protect Cameras to bypass authentication checks, giving them complete control over the camera settings and feeds.

What to do

The consequences could be absolutely devastating. An attacker could not only spy on your surroundings but also manipulate camera feeds and settings, potentially leading to privacy violations or even property theft. Your security could be turned against you in an instant! To secure your system, disable Auto-Adopt Bridge Devices immediately and ensure your cameras are not accessible from unauthorized networks. Additionally, consider updating to the latest version of UniFi Protect to patch any security issues and consult your firewall settings to restrict access. 🛡️ You've got this! With these steps, you'll tighten up your defenses and keep those cameras secure! 💪🔒

The record
Technical detail
CVSS v3.0
9.6 · CRITICAL
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00512 · 42.8th percentile
Published
2025-03-01T01:52Z
EPSS history
Timeline
  • 01 MAR 01:52Z
    An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor with access to UniFi…
    cvelistv5