CVE-2026-116837

Full vulnerability record from the local CVENow database.

Description

A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.

Severity

HIGH

CVSS score

8.8 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

fe490ce8-0395-4072-90d8-2707e1bdf984

Published

2026-10-27 01:19:06.860000

Last modified

2026-10-27 15:08:50.630000

View original CVE JSON

{
  "id": "CVE-2026-116837",
  "sourceIdentifier": "fe490ce8-0395-4072-90d8-2707e1bdf984",
  "published": "2026-10-27T01:19:06.860",
  "lastModified": "2026-10-27T15:08:50.630",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device."
    }
  ],
  "affected": [
    {
      "source": "fe490ce8-0395-4072-90d8-2707e1bdf984",
      "affectedData": [
        {
          "vendor": "Ubiquiti Inc",
          "product": "airMAX M",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "6.3.26",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Ubiquiti Inc",
          "product": "LTU PTMP",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "2.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Ubiquiti Inc",
          "product": "LTU PTP",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.5.7",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Ubiquiti Inc",
          "product": "SolarPoint / SolarSwitch",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "2.0.3",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "fe490ce8-0395-4072-90d8-2707e1bdf984",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "fe490ce8-0395-4072-90d8-2707e1bdf984",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://uisp.community.ui.com/releases/Security-Advisory-Bulletin-071/7d4d42cf-09e4-44d3-9c19-649cac8c6af3",
      "source": "fe490ce8-0395-4072-90d8-2707e1bdf984"
    }
  ]
}