EUVD-2026-66405
GHSA-ff9h-mmj4-g6xx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network foothold on switch segment
-
DeliveryCraft malicious DHCPv6 packet
-
ExploitTrigger heap buffer overflow in DHCPv6 handler
-
ExecutionExecute arbitrary code on switch
-
ImpactFull device control and traffic interception
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) the EdgeMAX EdgeSwitch to have DHCPv6 enabled - the description explicitly scopes the flaw to a 'DHCPv6-enabled' device, so switches without DHCPv6 active are not exposed; and (2) attacker presence on an adjacent network (AV:A), meaning the same link-local/L2 segment as the switch, not routable internet access. No authentication is required (PR:N) and no user interaction is needed (UI:N). Affected versions are EdgeMAX EdgeSwitch below 1.12.2; upgrading to 1.12.2 or later remediates. The principal limiting factors are the DHCPv6-enabled configuration dependency and the requirement for Layer-2 adjacency, which together confine exploitation to attackers who already have a foothold on the local network segment. |
| Impact | Signals are largely consistent and point to a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a low-complexity, unauthenticated attack yielding full compromise, and SSVC agrees on Technical Impact: total. However, SSVC rates Exploitation as 'none' and Automatable as 'no', and the EPSS score is low at 0.27% (19th percentile), indicating no observed exploitation and low near-term probability. The vulnerability is NOT in CISA KEV and there is no public exploit identified at time of analysis - so this is 'confirmed actively exploited' is NOT applicable. The key limiting factor that reconciles the high base score with the low real-world signals is the AV:A (adjacent network) requirement: an attacker must already be on the same link/L2 segment as the switch, and DHCPv6 must be enabled. This is a genuine high-severity patch priority for exposed/untrusted-segment deployments, but the adjacency requirement and 'Automatable: no' finding mean it is unlikely to see mass, wormable exploitation - treat as high priority for network infrastructure on shared or untrusted LANs, standard priority elsewhere. |
| Exploit ScenarioDerived | An attacker positioned on an adjacent network segment (same link/VLAN) as a DHCPv6-enabled EdgeMAX EdgeSwitch sends a crafted DHCPv6 message that overflows a heap buffer in the switch's DHCPv6 handling, corrupting memory to achieve remote code execution on the device. No authentication or user interaction is required (PR:N/UI:N), but the attacker must have link-local reachability to the target. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
Unauthenticated remote code execution is possible on Ubiquiti EdgeMAX EdgeSwitch devices that have DHCPv6 enabled, triggered by a heap-based buffer overflow (CWE-122) reachable from the local Layer-2 segment. Only switches running firmware below 1.12.2 with DHCPv6 active in the configuration are exposed, and the attacker must already be positioned on an adjacent network (CVSS 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rather than reaching the device over the internet. Vendor patch is available in EdgeMAX EdgeSwitch 1.12.2; no public exploit code has been identified at time of analysis and EPSS is low at 0.27% (19th percentile), consistent with CISA SSVC reporting no observed exploitation and a non-automatable attack path.
Earlier versions of this analysis (1)
Remote code execution in Ubiquiti EdgeMAX EdgeSwitch devices allows an attacker on an adjacent network to fully compromise the switch by exploiting a heap-based buffer overflow in its DHCPv6 handling. The flaw affects EdgeSwitch units that have DHCPv6 enabled and requires no authentication or user interaction, only Layer 2/link-local reachability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.6 rating and network-daemon attack surface make it a high-priority patching target.
RemediationAI
Vendor-released patch: upgrade EdgeMAX EdgeSwitch firmware to 1.12.2 or later, per Ubiquiti Security Advisory Bulletin 068 (https://uisp.community.ui.com/releases/Security-Advisory-Bulletin-068-068/b95ea5e8-1a80-4ffc-ad42-625eae300cc9) and the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-77532); this is the primary and definitive fix and should be scheduled for all affected switches even though EPSS is low and no public exploit or KEV entry currently exists. If immediate upgrade is not feasible, disable DHCPv6 on any EdgeSwitch that does not require it - this removes the vulnerable code path but has the side effect of breaking IPv6 address assignment, prefix delegation and DHCPv6-provided DNS for downstream hosts, so it is only viable where IPv6 clients use SLAAC or static configuration instead. Additionally, restrict Layer-2 adjacency by segregating untrusted access ports into separate VLANs from switch management and from any DHCPv6-serving segments, disable unused access ports, and enable DHCP snooping-style filtering or port ACLs where the platform supports them to limit which hosts can inject DHCPv6 traffic; these controls reduce the attacker population but do not patch the underlying memory-safety defect and can complicate legitimate IPv6 client onboarding. Monitor for unexpected DHCPv6 traffic on segments that should not carry it as a detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a heap buffer overflow (CWE-122) in the DHCPv6 handling code of Ubiquiti EdgeMAX EdgeSwitch firmware. DHCPv6 is a UDP-based protocol carried over link-local multicast and unicast traffic, so processing occurs before any authentication or management-plane authorization - an attacker on the same Layer-2 segment can send crafted DHCPv6 messages that are parsed by the switch's DHCPv6 component and overflow a heap-allocated buffer. Successful corruption of heap memory can be leveraged to redirect execution flow and achieve code execution in the context of the affected network service, giving complete loss of confidentiality, integrity and availability (C:H/I:H/A:H) on the device. The CPE record cpe:2.3:a:ubiquiti_inc:edgemax_edgeswitch:*:*:*:*:*:*:*:* and the ENISA EUVD affected range "EdgeMAX EdgeSwitch 0 < 1.12.2" both point to the EdgeSwitch firmware line prior to 1.12.2 as the vulnerable population. Because the vector is AV:A with PR:N and UI:N, no credentials and no user interaction are required, but Layer-2 adjacency is mandatory; the DHCPv6-enabled configuration dependency means deployments that never activate DHCPv6 functionality are not on the attack path described.
Know when Edgemax Edgeswitch gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
DHCPv6 is a link-local protocol so AV:A; crafted packet needs no auth or interaction (PR:N/UI:N/AC:L); RCE on the device yields total C/I/A impact with scope unchanged.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
Lifecycle Timeline
4DescriptionCVE.org
A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code Execution on such device.
Executive ViewAI
Ubiquiti EdgeMAX EdgeSwitch devices running firmware below 1.12.2 with DHCPv6 enabled can be fully compromised by an unauthenticated attacker who already has a foothold on the same Layer-2 network segment, allowing arbitrary code execution with high impact to confidentiality, integrity, and availability. Because exploitation requires an adjacent-network position rather than internet exposure, the practical risk is concentrated in environments where untrusted or compromised endpoints, guest devices, or third-party equipment share network segments with core switching infrastructure. A vendor patch exists in EdgeMAX EdgeSwitch 1.12.2, and no public exploit code or observed exploitation has been identified, so leadership should treat this as a manageable but time-sensitive remediation priority for any unpatched switches with DHCPv6 active.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB