CVE-2025-23115 & CVE-2025-23116: Hackers Can Hijack Ubiquiti UniFi Protect Cameras
do son 
Ubiquiti, a leading provider of networking equipment, has issued a critical security advisory concerning multiple vulnerabilities discovered in its UniFi Protect line of cameras. These vulnerabilities, discovered by various security researchers participating in the Zero Day Initiative’s Pwn2Own competition, range from remote code execution to authentication bypass, leaving user systems potentially exposed to attackers.
One of the most severe vulnerabilities, identified as CVE-2025-23115, allows for remote code execution (RCE). This vulnerability, with a CVSS v3.0 base score of 9.0 (Critical), could enable a malicious actor with access to the camera’s management network to take complete control of the device.
Another critical flaw, tracked as CVE-2025-23116, allows for authentication bypass when the Auto-Adopt Bridge Devices feature is enabled. This vulnerability, with a CVSS v3.0 base score of 9.6 (Critical), could permit an attacker on the camera’s adjacent network to seize control of the device.
Ubiquiti has also addressed three medium-rated vulnerabilities:
- CVE-2025-23117: Insufficient firmware update validation, allowing unauthorized changes to the camera system.
- CVE-2025-23118: Improper certificate validation, enabling unauthorized modifications to the camera system.
- CVE-2025-23119: Improper neutralization of escape sequences, potentially leading to authentication bypass and RCE.
Ubiquiti urges users to update their UniFi Protect Cameras to version 4.74.106 or later and their UniFi Protect Application to version 5.2.49 or later to mitigate these vulnerabilities.
As network-connected devices become increasingly prevalent, it is crucial for users and organizations to remain vigilant and take necessary steps to secure their systems against potential threats.
Related Posts:
- CVE-2024-27981: Critical Vulnerability Patched in Ubiquiti UniFi Network Application
- Hacker group Anonymous controls over 400 Russian cameras
- Synology Camera Critical Vulnerabilities Patched: Upgrade Immediately
- Critical Flaw in Synology Camera Firmware Expose Devices to RCE and DoS Attacks
- Synology Issues Patches for Critical Camera Flaws Discovered at Pwn2Own
