MEDIUM✓ PATCH🇵🇱 Wersja polska

CVE-2026-21639

CVSS 5.4v3.1pub. 2026-01-08upd. 2026-01-14

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product. Affected Products: airMAX AC (Version 8.7.20 and earlier) airMAX M (Version 6.3.22 and earlier) airFiber AF60-XG (Version 1.2.2 and earlier) airFiber AF60 (Version 2.6.7 and earlier) Mitigation: Update your airMAX AC to Version 8.7.21 or later. Update your airMAX M to Version 6.3.24 or later. Update your airFiber AF60-XG to Version 1.2.3 or later. Update your airFiber AF60 to Version 2.6.8 or later.

CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

  • Ui Airfiber Af60

    HW
    Ui
    wszystkie wersje

  • Ui Airfiber Af60 Firmware

    OS
    Ui
    < 2.6.8

  • Ui Airfiber Af60 Xg

    HW
    Ui
    wszystkie wersje

  • Ui Airfiber Af60 Xg Firmware

    OS
    Ui
    < 1.2.3

  • Ui Airmax Ac

    HW
    Ui
    wszystkie wersje

  • Ui Airmax Ac Firmware

    OS
    Ui
    < 8.7.21

  • Ui Airmax M

    HW
    Ui
    wszystkie wersje

  • Ui Airmax M Firmware

    OS
    Ui
    < 6.3.24
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2015-9266CRITICAL9.8ten sam produkt

The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch)...

CVE-2017-0938HIGH7.5ten sam produkt

Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Dis...

CVE-2022-44565MEDIUM5.3ten sam produkt

An improper access validation vulnerability exists in airMAX AC <8.7.11, airFiber 60/LR <2.6.2, airFiber 60 XG...

CVE-2026-34908CRITICAL10.0⚠ KEVPL ✓ten sam vendor

Nieprawidłowa kontrola dostępu w UniFi OS — nieautoryzowane zmiany systemowe

CVE-2026-34909CRITICAL10.0⚠ KEVPL ✓ten sam vendor

Path Traversal w UniFi OS — dostęp do plików systemowych i przejęcie konta