External risk intelligence

UniFi Access API Misconfiguration Allows Unauthorized Management Access.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-52665

The vulnerability exists within a door access management application intended for use within a management network. While it involves a network-accessible API, this component is designed for internal administrative control of physical security hardware rather than being a public-facing service exposed to the open internet in standard deployment configurations.

Missing Authentication

Ui Unifi Access

3.3.22 to before 4.0.21

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A misconfiguration in the UniFi Access application's management API, present in certain versions, could allow unauthorized access to sensitive controls if an attacker is already on the management network. This poses a risk to the integrity and confidentiality of access control systems.

Unauthenticated API access is possible.
Protects physical access control systems.
Confirm UniFi Access software is updated.

Attack Path

How an attacker could exploit the issue

An attacker with initial access to a management network could potentially reach a vulnerable management API exposed by the UniFi Access application due to a misconfiguration. This API, lacking proper authentication, could then be manipulated to compromise the system.

Entry condition: Management network access.
Trigger point: Unauthenticated management API.
Resulting risk: High impact to confidentiality, integrity, and availability.

Live Threat

Current exploitation, exposure, and threat context

When a malicious actor gains access to the management network, a misconfiguration in UniFi's door access application could expose its management API without requiring authentication. This scenario could potentially impact the availability and integrity of the door access system.

Management API access.
Exploitable via management network access.
System availability and integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given this vulnerability's focus on the UniFi Access application's management API and its exposure without proper authentication, the primary responsibility likely falls to the infrastructure or platform teams managing the UniFi ecosystem, in conjunction with the security team responsible for network and application security. The first practical step involves identifying all instances of the UniFi Access application, assessing their network exposure and criticality, pinpointing the accountable owner for each instance, and then developing a prioritized remediation plan.

Infrastructure and platform teams own.
Verify management API network exposure.
Plan UniFi Access application updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the UniFi Access application?

UniFi Access is software used to manage physical security hardware, such as door controllers and readers. It provides a centralized interface for administrators to handle building entry permissions and monitor physical access points within a facility's network infrastructure.

What does CWE-306 mean for CVE-2025-52665?

CWE-306 refers to a Missing Authentication for Critical Function weakness. In the context of CVE-2025-52665, it means the application contains a management API that fails to verify the identity of the person or system attempting to use it, effectively allowing unauthenticated access to sensitive control functions.

How is this API vulnerability triggered?

An attacker must have initial access to the management network where the UniFi Access software is running to reach the vulnerable API. Accessing the system from outside the local management network or through non-administrative channels does not trigger this specific flaw.

Is my UniFi Access instance at risk?

Halo Surface Signal notes that this application is designed for internal administrative control rather than being a public-facing service. While the API is network-accessible, the risk is typically highest for instances that share a network with untrusted devices or lack proper internal network segmentation.

How do I secure my environment against this?

The most effective response is to update the UniFi Access application to version 4.0.21 or later, which resolves the authentication misconfiguration. Before updating, identify all running instances and verify their network placement to ensure they are properly isolated on the management network.

References

community.ui.com/releases/Security-Advisory-Bulletin-056/ce97352d-91cd…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.