Is CVE-2019-25651 actively exploited?

No active exploitation of CVE-2019-25651 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2019-25651 be exploited remotely?

Partially. CVE-2019-25651 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2019-25651?

CVE-2019-25651 has a CVSS score of 8.3 (HIGH).

HOME VULNERABILITIESCVE-2019-25651

HIGH

CVE-2019-25651

CWE-327Published: March 27, 2026· Updated: Mar 30, 2026

8.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:1.3th

Official Description

Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 uses AES-CBC encryption for device-to-controller communication, which contains cryptographic weaknesses that allow attackers to recover encryption keys from captured traffic. Attackers with adjacent network access can capture sufficient encrypted traffic and exploit AES-CBC mode vulnerabilities to derive the encryption keys, enabling unauthorized control and management of network devices.

NVD Source

Technical Analysis

CVE-2019-25651 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.3.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.