ZDI-25-378: (Pwn2Own) Ubiquiti Networks UniFi Console Missing Authentication for Critical Function Authentication Bypass Vulnerability
This vulnerability allows network-adjacent attackers to bypass authentication on affected Ubiquiti Networks UniFi Console devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.6. The following CVEs are assigned: CVE-2025-23116.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-25-378?
The severity of ZDI-25-378 is rated at 9.6 on the CVSS scale, indicating a critical vulnerability.
How do I fix ZDI-25-378?
To fix ZDI-25-378, you should update your Ubiquiti Networks UniFi Console to the latest version provided by the vendor.
Who is affected by ZDI-25-378?
ZDI-25-378 affects Ubiquiti Networks UniFi Console devices that are accessible to network-adjacent attackers.
What type of attack does ZDI-25-378 facilitate?
ZDI-25-378 facilitates authentication bypass attacks, allowing unauthorized access to the affected devices.
Is authentication required to exploit ZDI-25-378?
No, authentication is not required to exploit the ZDI-25-378 vulnerability.