HIGHVulnerability
Verified
Global
NVD HIGH: CVE-2019-25651 — Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW pr...
Friday, March 27, 2026 at 10:16 PM UTC·Source: NIST NVD
Updated: Thursday, April 2, 2026 at 05:46 PM UTC
Executive Summary
Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 uses AES-CBC encryption for device-to-controller communication, which contains cryptographic weaknesses that allow attackers to recover encryption keys from captured traffic. Attackers with adjacent net
Analysis
Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 uses AES-CBC encryption for device-to-controller communication, which contains cryptographic weaknesses that allow attackers to recover encryption keys from captured traffic. Attackers with adjacent network access can capture sufficient encrypted traffic and exploit AES-CBC mode vulnerabilities to derive the encryption keys, enabling unauthorized control and management of network devices.
CVSS Score: 8.3. Published: 2026-03-27T22:16:19.107.