TI-2019-15704 Aliases CVE-2019-25651 GHSA-m2rv-r87h-2v59

Ubiquiti UniFi Devices Use of AES-CBC Allows Key Recovery and Unauthorized Device Control

LOW 39CWE-327Published 2026-03-27 · Updated 2026-07-15

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-327.

Summary

Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 uses AES-CBC encryption for device-to-controller communication, which contains cryptographic weaknesses that allow attackers to recover encryption keys from captured traffic. Attackers with adjacent network access can capture sufficient encrypted traffic and exploit AES-CBC mode vulnerabilities to derive the encryption keys, enabling unauthorized control and management of network devices.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00084 0th percentileScored 2026-11-07

Fix Fixed UniFi Network Controller (Ubiquiti): 5.6.42, 5.10.12UniFi UAP Firmware (Ubiquiti): 4.0.6+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Ubiquiti	UniFi Network Controller	before 5.6.42; 5.6.43 to before 5.10.12	5.6.42, 5.10.12	Patch available	CNA
Ubiquiti	UniFi UAP Firmware	before 4.0.6	4.0.6	Patch available	CNA
Ubiquiti	UniFi UAP-AC Firmware	before 3.8.17	3.8.17	Patch available	CNA
Ubiquiti	UniFi USW Firmware	before 4.0.6	4.0.6	Patch available	CNA
Ubiquiti	UniFi USG Firmware	before 4.4.34	4.4.34	Patch available	CNA

UniFi Network Controller VendorUbiquiti Affected before 5.6.42; 5.6.43 to before 5.10.12 Fixed in 5.6.42, 5.10.12 Patch available CNA
UniFi UAP Firmware VendorUbiquiti Affected before 4.0.6 Fixed in 4.0.6 Patch available CNA
UniFi UAP-AC Firmware VendorUbiquiti Affected before 3.8.17 Fixed in 3.8.17 Patch available CNA
UniFi USW Firmware VendorUbiquiti Affected before 4.0.6 Fixed in 4.0.6 Patch available CNA
UniFi USG Firmware VendorUbiquiti Affected before 4.4.34 Fixed in 4.4.34 Patch available CNA

Remediation

Fix · CNA UniFi Network Controller (Ubiquiti) Fixed in 5.6.42, 5.10.12
Fix · CNA UniFi UAP Firmware (Ubiquiti) Fixed in 4.0.6
Fix · CNA UniFi UAP-AC Firmware (Ubiquiti) Fixed in 3.8.17
Fix · CNA UniFi USW Firmware (Ubiquiti) Fixed in 4.0.6
Fix · CNA UniFi USG Firmware (Ubiquiti) Fixed in 4.4.34

Timeline

2026-10-02 Threatist record created from CVE-2019-25651
2026-10-03 Alias added: GHSA-m2rv-r87h-2v59

References

Advisory 1

https://community.ui.com/releases/Security-Advisory-Bulletin-004-004/462e561b-9efd-4c23-bfa7-53d59cc64ecb

TI-2026-27142 Improper input validation in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
TI-2026-27141 Path traversal in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
TI-2026-27140 Improper access control in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
TI-2010-05027 On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi… KEVCVSS 3.1CRITICAL 9.8
TI-2020-19187 AirControl 1.4.2 - PreAuth Remote Code Execution CVSS 4.0CRITICAL 9.3
TI-2015-07644 Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload CVSS 3.0CRITICAL 9.8

See all 206 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences