Critical9.0Ubiquiti

Critical [CVE-2019-25651] Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC…

This critical-severity Ubiquiti advisory covers CVE-2019-25651 affecting UniFi Network Controller, UniFi UAP Firmware, UniFi UAP-AC Firmware.

CVE-2019-25651 Published Mar 27, 2026Updated by vendor Jun 17, 2026

CVE-2019-25651

Affected products & platforms

UbiquitiUniFi Network / OS

Open vendor advisory

Android app · Google Play

Monitor future Ubiquiti CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 uses AES-CBC encryption for device-to-controller communication, which contains cryptographic weaknesses that allow attackers to recover encryption keys from captured traffic.

Attackers with adjacent network access can capture sufficient encrypted traffic and exploit AES-CBC mode vulnerabilities to derive the encryption keys, enabling unauthorized control and management of network devices. Affected products named by the advisory: UniFi UAP Firmware; UniFi UAP-AC Firmware; UniFi USW Firmware; UniFi USG Firmware.

Affected versions

before 5.10.12
before 4.0.6
before 3.8.17
before 4.4.34

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Fixed versions

5.10.12
4.0.6
3.8.17
4.4.34

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Mitigation

Upgrade to a fixed release: 5.10.12, 4.0.6, 3.8.17, 4.4.34. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.