CVE-2025-23123

A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a heap buffer overflow vulnerability in the…

Critical · published May 19, 2025

CVSS v3.0
10.0
EPSS
1%
Percentile
67.0
In the wild
Unconfirmed
What it is

🚨 A malicious actor with a key to the management network can exploit a heap buffer overflow in UniFi Protect Cameras, allowing for remote code execution! 🔥 Think of this like an intruder sneaking into a control room and tampering with the surveillance feeds—managing to switch off the cameras entirely without anyone noticing. It's a shocking breach of trust! An attacker could fully compromise your camera's functionality—viewing, manipulating, or even disabling your security system entirely. This is not just a breach; it's a potential nightmare scenario for your physical security!

Put simply

Think of this like an intruder sneaking into a control room and tampering with the surveillance feeds—managing to switch off the cameras entirely without anyone noticing. It's a shocking breach of trust! This heap buffer overflow vulnerability allows an attacker with network access to execute arbitrary code on the camera's firmware, which can lead to complete takeover of the device.

What to do

An attacker could fully compromise your camera's functionality—viewing, manipulating, or even disabling your security system entirely. This is not just a breach; it's a potential nightmare scenario for your physical security! Update the firmware of your UniFi Protect Cameras to version 4.75.44 or later immediately to close this critical vulnerability. It's also wise to review your network access controls to ensure that only authorized personnel can reach the management network. You can tackle this! Keep your systems updated and your network safe, and you'll be one step closer to achieving security hero status! 🛡️

The record
Technical detail
CVSS v3.0
10.0 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01163 · 67.0th percentile
Published
2025-05-19T01:25Z
EPSS history
Timeline
  • 19 MAY 01:25Z
    A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a heap buffer overflow vulnerability in the…
    cvelistv5