CVE-2025-27212: Command Injection Vulnerability in UniFi Access Devices

Overview

The recent discovery of the CVE-2025-27212 vulnerability has raised significant concern within the cybersecurity community due to its high severity and the potential for extensive system compromise. This vulnerability specifically affects a range of UniFi Access devices, which could have serious implications for countless businesses and organizations that use these devices for access management. It is particularly alarming as it allows a malicious actor to carry out a command injection if they gain access to the UniFi Access management network.
This command injection vulnerability is a critical issue because it can potentially provide an attacker with the ability to execute arbitrary commands on the target system. This opens the door for other malicious activities such as unauthorized system modifications, data theft, and further system exploitation.

Vulnerability Summary

CVE ID: CVE-2025-27212
Severity: Critical (CVSS Score 9.8)
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

UniFi Access Reader Pro | Version 2.14.21 and earlier
UniFi Access G2 Reader Pro | Version 1.10.32 and earlier
UniFi Access G3 Reader Pro | Version 1.10.30 and earlier
UniFi Access Intercom | Version 1.7.28 and earlier
UniFi Access G3 Intercom | Version 1.7.29 and earlier
UniFi Access Intercom Viewer | Version 1.3.20 and earlier

How the Exploit Works

At a high level, this exploit takes advantage of improper input validation in certain UniFi Access devices. This flaw allows an attacker to inject malicious commands that the system then executes. To carry out this attack, a malicious actor would need access to the UniFi Access management network. This could be achieved through a variety of methods, including but not limited to, social engineering, network intrusion, or exploiting another vulnerability.

Conceptual Example Code

This is a conceptual example of how the vulnerability might be exploited. Note that the exact details of the exploit would vary depending on the specific circumstances and the attacker’s goals.

POST /unifi/access/endpoint HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "command": "; rm -rf /" }

In this example, the attacker sends a POST request to a vulnerable endpoint on the target system. The request payload includes a command preceded by a semicolon, which in many command-line environments allows for command chaining. The command `rm -rf /` is a destructive command that, if executed, would delete all files on the target system.