CVE-2019-25652 - CVE House
Back to Database
Status published High CVE-2019-25652

UniFi Network Controller Improper Certificate Validation Leading to Credential Theft via MITM

Vulnerability Description

UniFi Network Controller before version 5.10.22 and 5.11.x before 5.11.18 contains an improper certificate verification vulnerability that allows adjacent network attackers to conduct man-in-the-middle attacks by presenting a false SSL certificate during SMTP connections. Attackers can intercept SMTP traffic and obtain credentials by exploiting the insecure SSL host verification mechanism in the SMTP certificate validation process.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-25652

Credits & Attribution

No credits recorded in the NVD database.

References

More from Ubiquiti

View All →
CVE-2024-45205
An Improper Certificate Validation on the UniFi iOS App managing...
High 7.1
CVE-2024-37380
A misconfiguration on UniFi U6+ Access Point could cause an...
Medium 5.3
CVE-2024-34786
UniFi iOS app 10.15.0 introduces a misconfiguration on 2nd Generation...
Unknown 0
CVE-2023-41721
Instances of UniFi Network Application that (i) are run on...
Critical 10
CVE-2023-32000
A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version...
Unknown 0

Affected Vendor

Affected Software

UniFi Network Controller
Vulnerable Versions:
0, 5.6.43, 5.11

Timeline

Official Publish: March 27th, 2026
Last Modified: July 15th, 2026
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-295

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle
Credential Access
T1040 Network Sniffing
Collection
T1552 Unsecured Credentials
Credential Access
T1071 Application Layer Protocol
Command and Control
T1565 Data Manipulation
Impact