EUVD-2026-66405Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Adjacent unauthenticated DHCPv6 message with no interaction gives AV:A/AC:L/PR:N/UI:N; I assess S:U since RCE executes within the device's own authority, whereas Ubiquiti's S:C treats the DHCP-component-to-OS boundary as a scope change.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code Execution on such device.
AnalysisAI
Remote code execution in Ubiquiti EdgeMAX EdgeSwitch devices allows an attacker on an adjacent network to fully compromise the switch by exploiting a heap-based buffer overflow in its DHCPv6 handling. The flaw affects EdgeSwitch units that have DHCPv6 enabled and requires no authentication or user interaction, only Layer 2/link-local reachability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target EdgeSwitch has DHCPv6 enabled - this is the explicit precondition named in the description ('a DHCPv6-enabled EdgeMAX EdgeSwitch'); units without DHCPv6 active are not exploitable via this path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated-CVSS one: the CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 9.6) describes low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact and a scope change from the DHCP component to the whole device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised any device on the same LAN segment as the EdgeSwitch (or a malicious insider on that VLAN) crafts a malformed DHCPv6 message and sends it to the switch's DHCPv6 service. The overflow corrupts heap memory in the handler and yields code execution on the switch, giving the attacker control of a core network device from which to intercept, redirect, or disrupt traffic. … |
| Remediation | Apply the firmware update referenced in Ubiquiti Security Advisory Bulletin 068 (https://uisp.community.ui.com/releases/Security-Advisory-Bulletin-068-068/b95ea5e8-1a80-4ffc-ad42-625eae300cc9); the exact fixed firmware version is not included in the available data, so confirm the target version directly from that advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Ubiquiti EdgeMAX EdgeSwitch deployments and identify devices with DHCPv6 enabled; disable DHCPv6 on all units where operationally unnecessary and document justified exceptions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today