CVE-2019-25652

UniFi Network Controller versions prior to 5.10.22 and 5.11.18 are affected by CVE-2019-25652, an improper certificate verification vulnerability (CWE-295). This flaw allows adjacent network attackers to conduct man-in-the-middle attacks by presenting false SSL certificates during SMTP connections. The vulnerability enables attackers to intercept SMTP traffic and potentially obtain credentials due to insecure SSL host verification. With a CVSS score of 7.5 (HIGH), it has low attack complexity and high impact on confidentiality, integrity, and availability, requiring no user interaction. There is currently no evidence of active exploitation, no public exploit code available, and minimal community discussion surrounding this CVE.