CVE-2025-24285 Command injection in UniFi Connect EV Station Lite
A malicious actor with network access can execute arbitrary commands on the UniFi Connect EV Station Lite due to improper input validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-24285?
CVE-2025-24285 is a critical command injection vulnerability in Ubiquiti Inc UniFi Connect EV Station Lite, published on 21 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with network access to the UniFi Connect EV Station Lite. Affected Products: UniFi Connect EV Station Lite (Version 1.5.1 and earlier) Mitigation: Update UniFi Connect EV Station Lite to Version 1.5.2 or later
Weakness: CWE-77
Which versions are affected by CVE-2025-24285?
How do I fix CVE-2025-24285?
No fix has been published for CVE-2025-24285 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-24285 being exploited?
There is no known exploitation of CVE-2025-24285 in the wild and no public exploit code.
Sources
Also known as GHSA-5fjw-g444-whhx.