CVE-2026-116837 - Vulnerability Details - OpenCVE

A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Ubiquiti	Airmax M Ltu Ptmp Ltu Ptp Solarpoint / Solarswitch

No data.

No data.

References

Link	Providers
https://uisp.community.ui.com/releases/Security-Advisory-Bulletin-071/7d4d42cf-09e4-44d3-9c19-649cac8c6af3

History

Tue, 03 Nov 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 28 Oct 2026 22:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Ubiquiti Ubiquiti airmax M Ubiquiti ltu Ptmp Ubiquiti ltu Ptp Ubiquiti solarpoint / Solarswitch
Vendors & Products		Ubiquiti Ubiquiti airmax M Ubiquiti ltu Ptmp Ubiquiti ltu Ptp Ubiquiti solarpoint / Solarswitch

Tue, 27 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Title	Heap-Based Buffer Overflow in Ubiquiti Network Devices

Tue, 27 Oct 2026 07:45:00 +0000

Type	Values Removed	Values Added
Title		Heap-Based Buffer Overflow in Ubiquiti Network Devices

Tue, 27 Oct 2026 04:30:00 +0000

Type	Values Removed	Values Added
Description		A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.
Weaknesses		CWE-122
References		https://uisp.community.ui.com/releases/Security-Advisory-Bulletin-071/7d4d42cf-09e4-44d3-9c19-649cac8c6af3
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Ubiquiti

Published: 2026-10-27T00:44:48.129Z

Updated: 2026-11-03T20:25:24.601Z

Reserved: 2026-10-27T00:05:21.469Z

Link: CVE-2026-116837

Vulnrichment

Updated: 2026-11-03T20:25:15.791Z

NVD

Status : Awaiting Analysis

Published: 2026-10-27T01:19:06.860

Modified: 2026-11-03T21:17:02.693

Link: CVE-2026-116837

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116837", "assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984", "state": "PUBLISHED", "assignerShortName": "Ubiquiti", "dateReserved": "2026-10-27T00:05:21.469Z", "datePublished": "2026-10-27T00:44:48.129Z", "dateUpdated": "2026-11-03T20:25:24.601Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984", "shortName": "Ubiquiti", "dateUpdated": "2026-10-27T00:44:48.129Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow", "type": "CWE"}]}], "affected": [{"vendor": "Ubiquiti Inc", "product": "airMAX M", "versions": [{"status": "affected", "version": "0", "lessThan": "6.3.26", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Ubiquiti Inc", "product": "LTU PTMP", "versions": [{"status": "affected", "version": "0", "lessThan": "2.4.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Ubiquiti Inc", "product": "LTU PTP", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.7", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Ubiquiti Inc", "product": "SolarPoint / SolarSwitch", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device."}]}], "references": [{"url": "https://uisp.community.ui.com/releases/Security-Advisory-Bulletin-071/7d4d42cf-09e4-44d3-9c19-649cac8c6af3"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T20:24:57.398725Z", "id": "CVE-2026-116837", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T20:25:24.601Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116837", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-03T20:24:57.398725Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T20:25:15.791Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ubiquiti Inc", "product": "airMAX M", "versions": [{"status": "affected", "version": "0", "lessThan": "6.3.26", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Ubiquiti Inc", "product": "LTU PTMP", "versions": [{"status": "affected", "version": "0", "lessThan": "2.4.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Ubiquiti Inc", "product": "LTU PTP", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.7", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Ubiquiti Inc", "product": "SolarPoint / SolarSwitch", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://uisp.community.ui.com/releases/Security-Advisory-Bulletin-071/7d4d42cf-09e4-44d3-9c19-649cac8c6af3"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.", "supportingMedia": [{"type": "text/html", "value": "A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow"}]}], "providerMetadata": {"orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984", "shortName": "Ubiquiti", "dateUpdated": "2026-10-27T00:44:48.129Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116837", "state": "PUBLISHED", "dateUpdated": "2026-11-03T20:25:24.601Z", "dateReserved": "2026-10-27T00:05:21.469Z", "assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984", "datePublished": "2026-10-27T00:44:48.129Z", "assignerShortName": "Ubiquiti"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "airMAX M", "vendor": "Ubiquiti Inc", "versions": [{"lessThan": "6.3.26", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "LTU PTMP", "vendor": "Ubiquiti Inc", "versions": [{"lessThan": "2.4.2", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "LTU PTP", "vendor": "Ubiquiti Inc", "versions": [{"lessThan": "1.5.7", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "SolarPoint / SolarSwitch", "vendor": "Ubiquiti Inc", "versions": [{"lessThan": "2.0.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "fe490ce8-0395-4072-90d8-2707e1bdf984"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device."}], "id": "CVE-2026-116837", "lastModified": "2026-11-03T21:17:02.693", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "fe490ce8-0395-4072-90d8-2707e1bdf984", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116837", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T20:24:57.398725Z", "version": "2.0.3"}}]}, "published": "2026-10-27T01:19:06.860", "references": [{"source": "fe490ce8-0395-4072-90d8-2707e1bdf984", "url": "https://uisp.community.ui.com/releases/Security-Advisory-Bulletin-071/7d4d42cf-09e4-44d3-9c19-649cac8c6af3"}], "sourceIdentifier": "fe490ce8-0395-4072-90d8-2707e1bdf984", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "fe490ce8-0395-4072-90d8-2707e1bdf984", "type": "Secondary"}]}