Ubia Ubox

published 2025-11-06 12 mo ago modified 2026-10-18 21 d ago also EUVD-2025-38194

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits: 0; none known

The Ubia camera ecosystem fails to adequately secure API credentials, potentially enabling an attacker to connect to backend services. The attacker would then be able to gain unauthorized access to available cameras, enabling the viewing of live feeds or modification of settings.

Patch / fix

fixed in 2

Ubia Ubox Android January 15, 2026
Ubia Ubox IOS January 15, 2026

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-310-02 updated 2026-02-03 cvss 6.5

Ubia Ubox (Update A)

Ubia Ubox Android <January_15_2026 Ubia Ubox IOS <January_15_2026
affected: vendor fix, mitigation “Ubia reports that the vulnerability has been resolved through a backend fix, and no user action is required to apply the patch.”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 12 mo ago (2025-11-07)

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA	4.0	7.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	4.0	7.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Ubia Ubox Android
Ubia Ubox IOS

Classification

Weakness

CWE-522 Insufficiently Protected Credentials

References

Sources

CVE List CVE-2025-12636
NVD CVE-2025-12636

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary