Read the docs
TI-2025-11589 Aliases CVE-2025-12636GHSA-vfq4-w7v4-7pf6

Insufficiently protected credentials in Ubia Ubox Android

Priority LOW 31CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-522.

Summary

The Ubia camera ecosystem fails to adequately secure API credentials, potentially enabling an attacker to connect to backend services. The attacker would then be able to gain unauthorized access to available cameras, enabling the viewing of live feeds or modification of settings.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00266 18th percentileScored 2026-11-07
Fix Fixed Ubox Android (Ubia): January 15, 2026Ubox IOS (Ubia): January 15, 2026

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UbiaUbox Androidbefore January 15, 2026January 15, 2026Patch availableCNA
UbiaUbox IOSbefore January 15, 2026January 15, 2026Patch availableCNA
  • Ubox Android VendorUbia Affected before January 15, 2026 Fixed in January 15, 2026 Patch available CNA
  • Ubox IOS VendorUbia Affected before January 15, 2026 Fixed in January 15, 2026 Patch available CNA

Remediation

  • Fix · CNA Ubox Android (Ubia) Fixed in January 15, 2026
  • Fix · CNA Ubox IOS (Ubia) Fixed in January 15, 2026

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-12636
  2. 2026-10-03 Alias added: GHSA-vfq4-w7v4-7pf6

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences