ZDI-CAN-25666: ZDI-25-376: (Pwn2Own) Ubiquiti Networks AI Bullet Improper Certificate Validation Authentication Bypass Vulnerability

Published Jun 11, 2025

Updated

This vulnerability allows network-adjacent attackers to bypass authentication on affected Ubiquiti Networks AI Bullet cameras. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2025-23118.

Affected Software

1 affected component

Ubiquiti Networks AI Bullet

Event History

Jun 11, 2025

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-25666?

The severity of ZDI-CAN-25666 is rated at 7.5 on the CVSS scale, indicating a high severity vulnerability.

How do I fix ZDI-CAN-25666?

To fix ZDI-CAN-25666, it is recommended to apply the latest firmware updates provided by Ubiquiti Networks for the AI Bullet cameras.

Who is affected by ZDI-CAN-25666?

ZDI-CAN-25666 affects users of Ubiquiti Networks AI Bullet cameras.

What type of attack can exploit ZDI-CAN-25666?

ZDI-CAN-25666 can be exploited by network-adjacent attackers to bypass authentication without needing any credentials.

What is the CVE associated with ZDI-CAN-25666?

The CVE associated with ZDI-CAN-25666 is CVE-2025-23118.