Security readout for executives and security teams
Plain-English summary
CVE-2019-25651 affects older Ubiquiti UniFi controllers and device firmware that used AES-CBC for device-to-controller communication. An attacker with adjacent network access who can capture enough encrypted traffic may recover encryption keys and use them to gain unauthorized control or management access to affected UniFi devices.
Executive priority
Prioritize remediation for sites with older UniFi controllers or firmware on shared, untrusted, or weakly segmented networks. Treat as high priority because successful exploitation could enable unauthorized device management, but the adjacent-network and high-complexity requirements reduce likelihood compared with remotely exploitable internet-facing flaws.
Technical view
The issue is a cryptographic weakness classified as CWE-327. The bundle describes affected versions as UniFi Network Controller prior to 5.10.12, excluding 5.6.42; UAP firmware prior to 4.0.6; UAP-AC, UAP-AC v2, and UAP-AC Outdoor firmware prior to 3.8.17; USW firmware prior to 4.0.6; and USG firmware prior to 4.4.34. CVSS v4.0 score is 8.7 with adjacent attack vector, high attack complexity, no privileges required, and no user interaction required.
Likely exposure
Exposure is most relevant for environments running the listed older UniFi Network Controller or UniFi device firmware where an attacker can access the same or adjacent network path and observe device-to-controller traffic. The bundle does not support treating this as a direct internet-exploitable issue.
Exploitation context
The source bundle does not indicate active exploitation, and KEV status is false. Exploitation requires adjacent network access and sufficient captured encrypted traffic; no exploit code or offensive procedure is provided here.
Researcher notes
Do not claim active exploitation from this bundle. The affected-version data should be validated against the Ubiquiti advisory before operational rollout, especially where product naming or firmware train differences matter.
Mitigation direction
- Upgrade UniFi Network Controller to 5.10.12 or later, while noting that 5.6.42 is listed as excluded from affected versions in the bundle.
- Upgrade UAP and USW firmware to 4.0.6 or later where applicable.
- Upgrade UAP-AC, UAP-AC v2, and UAP-AC Outdoor firmware to 3.8.17 or later where applicable.
- Upgrade USG firmware to 4.4.34 or later where applicable.
- Check Ubiquiti’s vendor advisory for product-specific upgrade guidance and any platform-specific exceptions.
- Restrict management and device-to-controller traffic to trusted network segments and reduce opportunities for adjacent traffic capture.
Validation and detection
- Inventory UniFi Network Controller versions and confirm whether any are older than 5.10.12, except 5.6.42 as noted in the bundle.
- Inventory UniFi UAP, UAP-AC, USW, and USG firmware versions against the affected version thresholds listed in the advisory data.
- Confirm upgraded devices reconnect to the controller normally after firmware or controller updates.
- Review network segmentation for UniFi management traffic and confirm only trusted administrative or device networks can observe or reach those paths.
- Monitor vendor advisories for any revised affected-version guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-327: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-25651 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source materials
- CVE List V5 sourceCVE List V5
- https://community.ui.com/releases/Security-Advisory-Bulletin-004-004/462e561b-9efd-4c23-bfa7-53d59cc64ecbCVE reference · vendor-advisory
- https://www.vulncheck.com/advisories/ubiquiti-unifi-devices-use-of-aes-cbc-allows-key-recovery-and-unauthorized-device-controlCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of a Broken or Risky Cryptographic Algorithm
Use of a Broken or Risky Cryptographic Algorithm represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.