CVE-2025-23091 — Ubiquiti Inc / UDM

Description (CNA)

An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM) attack during application update.

Affected (CNA)

Vendor / product	Versions
Ubiquiti Inc / UDM	affected 4.1.13 before 4.1.13
Ubiquiti Inc / UDM-Pro	affected 4.1.13 before 4.1.13
Ubiquiti Inc / UDM-SE	affected 4.1.13 before 4.1.13
Ubiquiti Inc / UDM-Pro-Max	affected 4.1.13 before 4.1.13
Ubiquiti Inc / UDW	affected 4.1.13 before 4.1.13
Ubiquiti Inc / UNVR	affected 4.1.11 before 4.1.11
Ubiquiti Inc / UNVR PRO	affected 4.1.11 before 4.1.11
Ubiquiti Inc / UCKP	affected 4.1.11 before 4.1.11
Ubiquiti Inc / UCK	affected 4.1.11 before 4.1.11
Ubiquiti Inc / UCK-Enterprise	affected 4.1.11 before 4.1.11
Ubiquiti Inc / UCG-Max	affected 4.1.13 before 4.1.13
Ubiquiti Inc / EFG	affected 4.1.13 before 4.1.13

CWE

No CWE identifiers supplied.

References

https://community.ui.com/releases/Security-Advisory-Bulletin-045-045/6011bc61-f2eb-457f-b71d-755703817aaf

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.