A critical cryptographic flaw in Ubiquiti UniFi devices allows attackers to recover AES-CBC keys that protect device-to-controller traffic. By capturing sufficient encrypted packets on the same network segment, an attacker can derive the keys and gain full control of the affected devices. This enables unauthorized configuration changes, firmware updates, or other management actions, effectively compromising the integrity of the network infrastructure.

The vulnerability impacts Ubiquiti UniFi Network Controller Software versions before 5.10.12 (excluding 5.6.42), Ubiquiti UniFi UAP firmware before 4.0.6, UniFi UAP-AC and UAP-AC v2 firmware before 3.8.17, UniFi USG firmware before 4.4.34, and UniFi USW firmware before 4.0.6. Systems with these firmware releases are at risk until patched.

The CVSS base score of 8.7 indicates a high severity vulnerability. Although the EPSS score is not available, the absence of the flaw from the KEV catalog suggests it has not yet been widely exploited in the wild, yet the attack requires only adjacent network access and traffic capture, making it relatively straightforward for an attacker. The compromise grants full administrative control over the devices, representing a significant threat to network security.