UniFi Access CVE-2025-52665

Exploitation requires network-level access to the UniFi management network, where the UniFi Access management API is reachable; on vulnerable versions (3.3.22 through 3.4.31) that API is exposed without any authentication (CWE-306), so no credentials, tokens, or user interaction are needed once management-network reachability exists. The primary limiting factor is network segmentation: an attacker must already be on, or able to route to, the management plane - this is NOT internet-wide unauthenticated access despite the CVSS AV:N metric. The flaw was introduced in Version 3.3.22 and does not affect versions before it or 4.0.21 and later, so version and deployment of the management plane bound the exposure.

Multiple signals point to this being a genuinely high-priority flaw, but with an important real-world caveat. The input CVSS is 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (CWE-306, Missing Authentication for a Critical Function), and the EPSS score of 41.09% at the 99th percentile is exceptionally high - placing it among the most exploitation-likely CVEs tracked. However, the signals partially conflict: the CVSS encodes AV:N (full network reachability), while the vendor description explicitly scopes exploitation to 'an actor with access to the management network.' This means raw network-wide unauthenticated exploitation is NOT accurate - exploitation requires a foothold on, or reachability to, the UniFi management network segment, which is a meaningful limiting factor the CVSS:N does not capture. There is NO CISA KEV listing and NO public POC referenced in the provided data, so despite the near-top EPSS percentile, there is no confirmation of active exploitation or weaponized exploit code. Net assessment: treat as a real, urgent patch priority for any environment running the affected UniFi Access versions, but recognize the attack is gated behind management-network access rather than being internet-wide. Verify management-plane exposure with the vendor advisory before assuming full AV:N applicability.

An attacker who has gained a position on the UniFi management network (e.g., via a compromised internal host, VLAN misconfiguration, or weakly segmented management plane) directly queries the UniFi Access management API, which in vulnerable versions is exposed without authentication. Because no credentials are required (PR:N, AC:L), the attacker reads and manipulates door-access configuration, potentially unlocking doors or altering access rules. No public exploit identified at time of analysis, though the trivial nature of the missing-authentication flaw makes exploitation straightforward for anyone already on the management segment.