Airmax M
Monthly
Cross-site request forgery in the web/management interface of Ubiquiti airMAX M devices running firmware below 6.3.26 allows an attacker to make unauthorized configuration changes and push the device into a denial-of-service condition by luring an already-authenticated administrator to an attacker-controlled page. No credentials for the device are required (PR:N), but the forged request only takes effect against the victim's live session, so the required user interaction (UI:R) is the main limiting factor; integrity impact is low while availability impact is high. Severity is rated CVSS 7.1, EPSS is low at roughly 0.10% (1st percentile), no public exploit code or PoC reference has been identified at time of analysis, and the issue is not in CISA KEV; Ubiquiti has released a fixed firmware version.
Command injection in Ubiquiti airMAX M devices running firmware below 6.3.26 is reachable through a cross-site request forgery weakness in the device's web management interface, letting an attacker who lures a logged-in administrator to a malicious page run commands on the device with high confidentiality and integrity impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms the attacker needs no credentials of their own, but exploitation depends on a victim holding an active authenticated management session while loading the attacker-controlled page. No CISA KEV listing and no public exploit were identified at time of analysis, and EPSS is low at 0.38% (32nd percentile), making this a genuine priority for this week rather than a drop-everything emergency.
Heap-based buffer overflow (CWE-122) in Ubiquiti airMAX M, LTU PTMP, LTU PTP and SolarPoint/SolarSwitch firmware lets an attacker who is already on the adjacent network (CVSS AV:A) execute arbitrary code on the device with no authentication and no user interaction (CVSS 3.1 base 8.8, PR:N/UI:N), giving full confidentiality, integrity and availability impact. The adjacency requirement, not any account or feature prerequisite, is the limiting factor: default deployments of unpatched versions are exposed once the attacker shares the wireless link or local L2 segment. Fixed firmware is available from the vendor (airMAX M 6.3.26, LTU PTMP 2.4.2, LTU PTP 1.5.7, SolarPoint/SolarSwitch 2.0.3); there is no CISA KEV listing and no public exploit was identified at time of analysis, and EPSS is low (0.21%, 12th percentile), which places this at a this_week rather than emergency priority.
Stored cross-site scripting in Ubiquiti airMAX M devices running firmware before 6.3.26 allows an attacker positioned on the adjacent network to plant script content that executes when a victim views it, and Ubiquiti states this can escalate privileges on the device. Exploitation requires adjacent-network access (AV:A) and user interaction (UI:R) with a victim, most plausibly an administrator, viewing the poisoned page, and the vendor further limits the issue to 'certain conditions' that the available sources do not specify; authentication is not required to trigger per the PR:N vector. Signals are moderate-to-elevated but not emergency-grade: EPSS is only 0.19% (9th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and a vendor patch is available in firmware 6.3.26.
Cross-site request forgery in the web/management interface of Ubiquiti airMAX M devices running firmware below 6.3.26 allows an attacker to make unauthorized configuration changes and push the device into a denial-of-service condition by luring an already-authenticated administrator to an attacker-controlled page. No credentials for the device are required (PR:N), but the forged request only takes effect against the victim's live session, so the required user interaction (UI:R) is the main limiting factor; integrity impact is low while availability impact is high. Severity is rated CVSS 7.1, EPSS is low at roughly 0.10% (1st percentile), no public exploit code or PoC reference has been identified at time of analysis, and the issue is not in CISA KEV; Ubiquiti has released a fixed firmware version.
Command injection in Ubiquiti airMAX M devices running firmware below 6.3.26 is reachable through a cross-site request forgery weakness in the device's web management interface, letting an attacker who lures a logged-in administrator to a malicious page run commands on the device with high confidentiality and integrity impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms the attacker needs no credentials of their own, but exploitation depends on a victim holding an active authenticated management session while loading the attacker-controlled page. No CISA KEV listing and no public exploit were identified at time of analysis, and EPSS is low at 0.38% (32nd percentile), making this a genuine priority for this week rather than a drop-everything emergency.
Heap-based buffer overflow (CWE-122) in Ubiquiti airMAX M, LTU PTMP, LTU PTP and SolarPoint/SolarSwitch firmware lets an attacker who is already on the adjacent network (CVSS AV:A) execute arbitrary code on the device with no authentication and no user interaction (CVSS 3.1 base 8.8, PR:N/UI:N), giving full confidentiality, integrity and availability impact. The adjacency requirement, not any account or feature prerequisite, is the limiting factor: default deployments of unpatched versions are exposed once the attacker shares the wireless link or local L2 segment. Fixed firmware is available from the vendor (airMAX M 6.3.26, LTU PTMP 2.4.2, LTU PTP 1.5.7, SolarPoint/SolarSwitch 2.0.3); there is no CISA KEV listing and no public exploit was identified at time of analysis, and EPSS is low (0.21%, 12th percentile), which places this at a this_week rather than emergency priority.
Stored cross-site scripting in Ubiquiti airMAX M devices running firmware before 6.3.26 allows an attacker positioned on the adjacent network to plant script content that executes when a victim views it, and Ubiquiti states this can escalate privileges on the device. Exploitation requires adjacent-network access (AV:A) and user interaction (UI:R) with a victim, most plausibly an administrator, viewing the poisoned page, and the vendor further limits the issue to 'certain conditions' that the available sources do not specify; authentication is not required to trigger per the PR:N vector. Signals are moderate-to-elevated but not emergency-grade: EPSS is only 0.19% (9th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and a vendor patch is available in firmware 6.3.26.