Read the docs
TI-2025-32742 Aliases CVE-2025-52663GHSA-v532-7c4x-249v

A vulnerability was identified in certain UniFi Talk devices where internal debugging…

Priority LOW 38CWE-489Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This issue could allow an attacker with access to the UniFi Talk management network to invoke internal debug operations through the device API. Affected Products: UniFi Talk Touch (Version 1.21.16 and earlier) UniFi Talk Touch Max (Version 2.21.22 and earlier) UniFi Talk G3 Phones (Version 3.21.26 and earlier) Mitigation: Update the UniFi Talk Touch to Version 1.21.17 or later. Update the UniFi Talk Touch Max to Version 2.21.23 or later. Update the UniFi Talk G3 Phones to Version 3.21.27 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00239 15th percentileScored 2026-11-07
Fix Fixed UniFi Talk Touch (Ubiquiti Inc): 1.21.17UniFi Talk Touch Max (Ubiquiti Inc): 2.21.23+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UbiquitiUniFi Talk Touch—1.21.17Patch availableCNA
UbiquitiUniFi Talk Touch Max—2.21.23Patch availableCNA
UbiquitiUniFi Talk G3 Phones—3.21.27Patch availableCNA
  • UniFi Talk Touch VendorUbiquiti Affected — Fixed in 1.21.17 Patch available CNA
  • UniFi Talk Touch Max VendorUbiquiti Affected — Fixed in 2.21.23 Patch available CNA
  • UniFi Talk G3 Phones VendorUbiquiti Affected — Fixed in 3.21.27 Patch available CNA

Remediation

  • Fix · CNA UniFi Talk Touch (Ubiquiti Inc) Fixed in 1.21.17
  • Fix · CNA UniFi Talk Touch Max (Ubiquiti Inc) Fixed in 2.21.23
  • Fix · CNA UniFi Talk G3 Phones (Ubiquiti Inc) Fixed in 3.21.27

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-52663
  2. 2026-10-03 Alias added: GHSA-v532-7c4x-249v

References

Other 1

  • TI-2026-27142 Improper input validation in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-27141 Path traversal in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-27140 Improper access control in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2010-05027 On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-19187 AirControl 1.4.2 - PreAuth Remote Code Execution CVSS 4.0CRITICAL 9.3
  • TI-2015-07644 Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload CVSS 3.0CRITICAL 9.8
See all 206 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences