Ubiquiti reports multiple vulnerabilities in Unifi Protect cameras and management
Take action: If you are using Ubiquiti Unifi Protect cameras and management, review the advisory. As a first item, make sure they are isolated from the internet and accessible only from trusted networks. Then organize a patch effort. It shouldn't be too difficult with central management.
Learn More
Ubiquiti has disclosed multiple critical security vulnerabilities affecting their Unifi Protect camera systems and management interface. The vulnerabilities were discovered by multiple security researchers through the Zero Day Initiative's Pwn2Own program.
The vulnerabilities affect all Unifi Protect Cameras up to version 4.74.88 and the Unifi Protect Application versions 5.2.46 and earlier. The identified vulnerabilities include:
- CVE-2025-23116 (CVSS score 9.6) - An authentication bypass vulnerability in the Unifi Protect Application with Auto-Adopt Bridge Devices enabled. This allows attackers with access to the adjacent network to take complete control of Unifi Protect Cameras without requiring authentication.
- CVE-2025-23115 (CVSS score 9.0) - A "Use After Free" vulnerability that enables remote code execution on cameras without prior authentication, allowing attackers to inject malicious code into the camera system.
- CVE-2025-23119 (CVSS score 7.5) - An improper neutralization of escape sequences vulnerability that could allow authentication bypass and remote code execution for attackers with access to the adjacent network.
- CVE-2025-23117 (CVSS score 6.8) - Insufficient firmware update validation that could allow authenticated attackers to make unauthorized changes to camera systems.
- CVE-2025-23118 (CVSS score 6.4) - Improper certificate validation that enables attackers with valid user credentials to make unauthorized modifications to camera systems.
Ubiquiti has released security updates, organizations should immediately upgrade their Unifi Protect Application to version 5.2.49 or newer and their camera firmware to version 4.74.106 or later.
