UniFi Network Controller versions prior to 5.10.22 and 5.11.x prior to 5.11.18 allow adjacent network attackers to bypass certificate verification during SMTP connections. By presenting a false SSL certificate, an attacker can perform a man‑in‑the‑middle attack and capture SMTP credentials. This weakness permits the theft of authentication data used to log into the controller, potentially giving full administrative control. The flaw is an example of CWE‑295, improper certificate validation.

The vulnerability affects Ubiquiti's UniFi Network Controller. Versions before 5.10.22 and for 5.11.x before 5.11.18 are vulnerable. Network administrators should verify the version of their UniFi Controller installation and consider upgrading if within those ranges.

The CVSS score of 7.6 indicates a high severity. Exploitation requires proximity to the network carrying the controller’s SMTP traffic; no external attack vector is described. Because the attacker can capture credentials, the impact can lead to full compromise of the controller. The EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalog. In practice, local attackers who can observe the controller’s SMTP traffic can exploit the flawed certificate validation to retrieve login information. Until patched, the risk remains high for environments that expose the controller over SMTP.