vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2019-25651

Ubiquiti UniFi Devices Use of AES-CBC Allows Key Recovery and Unauthorized Device Control

HIGH
8.3
CVSS Score
Published: March 27, 2026 at 09:16 PM UTC
Updated: June 17, 2026 at 02:32 AM UTC
7 products affected across 2 vendorsUnifi Network ControllerUnifi Uap FirmwareUniFi Network Application

Using UniFi Network Controller by Ubiquiti?

Get instant alerts when new vulnerabilities affect UniFi Network Controller - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.3
Exploit prediction
EPSS 0.1%
SSVC
No known exploit

Description

Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 uses AES-CBC encryption for device-to-controller communication, which contains cryptographic weaknesses that allow attackers to recover encryption keys from captured traffic. Attackers with adjacent network access can capture sufficient encrypted traffic and exploit AES-CBC mode vulnerabilities to derive the encryption keys, enabling unauthorized control and management of network devices.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Unifi Network Controller· UI
95%
v < 5.6.425.6.43 ≤ v < 5.10.12
Affected range stops below 5.10.12, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.6.42, so it looks safe — our inference, not a vendor statement
Unifi Uap Firmware· UI
95%
v < 4.0.6
Affected range stops below 4.0.6, so it looks safe — our inference, not a vendor statement
UniFi Network Application· Ubiquiti
60%
v < 5.6.425.6.43 ≤ v < 5.10.125.6.43
Affected range stops below 5.10.12, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.6.42, so it looks safe — our inference, not a vendor statement
UniFi UAP· Ubiquiti
60%
v < 4.0.6
Affected range stops below 4.0.6, so it looks safe — our inference, not a vendor statement
UniFi UAP-AC· Ubiquiti
60%
v < 3.8.17
Affected range stops below 3.8.17, so it looks safe — our inference, not a vendor statement
Unifi Usg· Ubiquiti
60%
v < 4.4.34
Affected range stops below 4.4.34, so it looks safe — our inference, not a vendor statement
Unifi Usw· Ubiquiti
60%
v < 4.0.6
Affected range stops below 4.0.6, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

Vendor Advisory
Source: cverecord
https://community.ui.com/releases/Security-Advisory-Bulletin-004-004/462e561b-9efd-4c23-bfa7-53d59cc64ecb
Third Party Advisory
Source: cverecord
https://www.vulncheck.com/advisories/ubiquiti-unifi-devices-use-of-aes-cbc-allows-key-recovery-and-unauthorized-device-control

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.3HIGHVulnCheck
Attack Vector
ADJACENT_NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusAWAITING ANALYSIS
CWE
CWE-327

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card