CVE-2025-24289 — Ubiquiti Inc / UCRM Client Signup Plugin

CVE-2025-24289

Ubiquiti Inc / UCRM Client Signup Plugin PUBLISHED

Description (CNA)

A Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1.3.4 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. The plugin is disabled by default.

Affected (CNA)

Vendor / product	Versions
Ubiquiti Inc / UCRM Client Signup Plugin	affected 1.3.5 before 1.3.5

CWE

No CWE identifiers supplied.

References

https://community.ui.com/releases/Security-Advisory-Bulletin-048-048/af007d99-bb6d-4368-a12f-75e84de19e8d

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.