Advisory Details

June 11th, 2025

(Pwn2Own) Ubiquiti Networks AI Bullet Improper Neutralization of Escape Sequences Authentication Bypass Vulnerability

CVE ID	CVE-2025-23119
CVSS SCORE	7.5, AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AFFECTED VENDORS	Ubiquiti Networks
AFFECTED PRODUCTS	AI Bullet
VULNERABILITY DETAILS	This vulnerability allows network-adjacent attackers to bypass authentication on affected Ubiquiti Networks AI Bullet cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of DHCP packet options. The issue results from insufficient neutralization of special characters. An attacker can leverage this vulnerability to bypass authentication on the system.
ADDITIONAL DETAILS	Ubiquiti Networks has issued an update to correct this vulnerability. More details can be found at: https://community.ui.com/releases/Security-Advisory-Bulletin-046-046/9649ea8f-93db-4713-a875-c3fd7614943f
DISCLOSURE TIMELINE	2024-11-15 - Vulnerability reported to vendor 2025-06-11 - Coordinated public release of advisory 2025-06-11 - Advisory Updated
CREDIT	Bongeun Koo(@kiddo_pwn), Dohyun Kim(@d0now), Junyoung Choi(@insp3ct0r_x), Wonbeen Im(@D0b6y), Juhyeop Lee(@leeju_04), Juyeong Lee(@ju_cheda), GuckHyeon Jin(@nang__lam), Jongmin Kim(@slyfizz3) of STEALIEN Inc.

BACK TO ADVISORIES