ZDI-CAN-25588: ZDI-25-378: (Pwn2Own) Ubiquiti Networks UniFi Console Missing Authentication for Critical Function Authentication Bypass Vulnerability
Published Jun 11, 2025
·Updated
This vulnerability allows network-adjacent attackers to bypass authentication on affected Ubiquiti Networks UniFi Console devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.6. The following CVEs are assigned: CVE-2025-23116.
Affected Software
1 affected component
Ubiquiti Networks UniFi Console
Event History
Jun 11, 2025
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-25588?
ZDI-CAN-25588 has a CVSS rating of 9.6, indicating a critical severity.
2
What does ZDI-CAN-25588 allow an attacker to do?
ZDI-CAN-25588 allows network-adjacent attackers to bypass authentication on Ubiquiti Networks UniFi Console devices.
3
Is authentication required to exploit ZDI-CAN-25588?
No, authentication is not required to exploit ZDI-CAN-25588.
4
Which device is affected by ZDI-CAN-25588?
ZDI-CAN-25588 affects Ubiquiti Networks UniFi Console devices.
5
How do I fix ZDI-CAN-25588?
To fix ZDI-CAN-25588, update your Ubiquiti Networks UniFi Console to the latest version provided by the manufacturer.