Full Report
Security researchers have uncovered a severe unauthenticated Remote Code Execution vulnerability in Ubiquiti’s UniFi OS that earned a substantial $25,000 bug bounty reward. Tracked as CVE-2025-52665, this critical flaw allows attackers to gain complete control of UniFi devices without requiring any credentials or user interaction, posing significant risks to organizations using UniFi Dream Machine routers […] The post Critical UniFi OS Flaw Enables Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Analysis Summary
# Vulnerability: Unauthenticated Remote Code Execution in UniFi OS via Misconfigured Backup API
## CVE Details
- CVE ID: CVE-2025-52665
- CVSS Score: Critical (Specific score not provided, inferred from severity and RCE impact)
- CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
## Affected Systems
- Products: Ubiquiti UniFi OS (Including UniFi Dream Machine routers and Access Control Systems)
- Versions: Not explicitly detailed in the summary, but affects versions running the vulnerable backup API endpoint.
- Configurations: Devices where the backup API endpoint (`/api/ucore/backup/export`) is externally accessible on port 9780 (bypassing intended loopback restriction).
## Vulnerability Description
The vulnerability is an OS Command Injection flaw originating from a severe misconfiguration of an API endpoint (`/api/ucore/backup/export`). This endpoint, intended to operate only on the local loopback interface, was discovered to be externally accessible via TCP port 9780. The orchestration system passes the user-supplied input from the `dir` parameter directly into chained shell commands (including `mktemp`, `chmod`, and `tar`) without sanitization or escaping. This allows an unauthenticated attacker to inject arbitrary shell commands by crafting a malicious JSON payload, leading to Remote Code Execution (RCE) with full system privileges.
## Exploitation
- Status: Exploited via proof-of-concept (researchers demonstrated system access, file exfiltration, and reverse shell establishment).
- Complexity: Low (Requires sending a specially crafted unauthenticated POST request).
- Attack Vector: Network (Remote)
## Impact
- Confidentiality: High (Allows attackers to read sensitive files like `/etc/passwd` and steal cryptographic keys/credentials).
- Integrity: High (Allows attackers to execute arbitrary commands, leading to system compromise).
- Availability: High (Complete control of the device, including access control infrastructure).
**Compounding Impact**: The vulnerability chain also exposed secondary unauthenticated API endpoints:
1. `/api/v1/user_assets/nfc`: Allows provisioning new credentials.
2. `/api/v1/user_assets/touch_pass/keys`: Exposes sensitive credential material, including Apple NFC keys and Google Pass authentication data (PEM-formatted private keys).
## Remediation
### Patches
- Specific patch versions are **not provided** in the context. Administrators must apply the latest available UniFi OS update addressing CVE-2025-52665.
### Workarounds
- Restricting network access to port 9780 or the UniFi OS management interface to trusted internal network segments or specific IP addresses until a patch can be applied.
- Reviewing firewall rules to ensure the backup orchestration service is not unnecessarily exposed externally.
## Detection
- **Indicators of Compromise (IoCs)**: Network traffic to the device on port 9780, especially POST requests against `/api/ucore/backup/export` containing shell metacharacters (e.g., `;`, `#`). Evidence of processes using `tar`, `chmod`, or `mktemp` started by the UniFi service user.
- **Detection Methods and Tools**: Network intrusion detection systems (NIDS) monitoring port 9780 for suspicious payload content; host-based monitoring for command execution within the UniFi service context.
## References
- Vendor Advisories: Check Ubiquiti security advisories for CVE-2025-52665 resolution.
- Relevant Links:
- [gbhackers.com/critical-unifi-os-flaw-enables-remote-code-execution/](https hxx://gbhackers.com/critical-unifi-os-flaw-enables-remote-code-execution/)
- [catchify.sa/post/cve-2025-52665-rce-in-unifi-os-25-000/](https hxx://www.catchify.sa/post/cve-2025-52665-rce-in-unifi-os-25-000/)