CVE-2025-27214

A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical or adjacent access…

Critical · published August 21, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

🚨 A sneaky physical access flaw lets an attacker reset your UniFi Connect EV Station Pro like flipping a light switch! ⚡ Think of it as someone being able to hit the reset button on your smart home hub without any verification, wiping your settings faster than a server rebooting after a power outage! If a malicious actor gains access, they could reset the device to factory settings, erasing all configurations and potentially leaving your network vulnerable. This could lead to unauthorized access to connected devices and disruption of services, which is absolutely devastating for any user relying on this technology!

Put simply

Think of it as someone being able to hit the reset button on your smart home hub without any verification, wiping your settings faster than a server rebooting after a power outage! This vulnerability arises from a missing authentication check for critical functions, allowing anyone with physical or nearby access to perform an unauthorized factory reset on the device.

What to do

If a malicious actor gains access, they could reset the device to factory settings, erasing all configurations and potentially leaving your network vulnerable. This could lead to unauthorized access to connected devices and disruption of services, which is absolutely devastating for any user relying on this technology! To protect your system, immediately update your UniFi Connect EV Station Pro to version 1.5.27 or later. Additionally, ensure physical security measures are in place to restrict access to the device. You've got this! Follow these steps, and you'll have your device secured in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00397 · 32.8th percentile
Published
2025-08-21T00:01Z
EPSS history
Timeline
  • 21 AUG 00:01Z
    A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical or adjacent access…
    cvelistv5