A local attacker with low privileges can exploit an External Control of File Name or Path vulnerability in WiFiman Desktop to run arbitrary commands with root privileges on the host. The attacker must already have an account on the device, and internet exposure is not a factor. According to the CNA record, the macOS build is affected; the NVD entry was still awaiting analysis at the time of research.
Ubiquiti · WiFiman Desktop
Ubiquiti airMAX M outdoor wireless radios are affected by a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). An attacker who lures a logged-in administrator to a malicious web page can make unauthorized configuration changes and cause a denial of service on the device. The attack requires user interaction and an authenticated session, and there is no confidentiality impact.
Ubiquiti · airMAX M
Ubiquiti airMAX M devices are affected by a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). An attacker who lures a logged-in administrator to a malicious web page can make the device execute a command injection. The attack needs no network position, but an authenticated user must visit the malicious page. The CNA rates the issue with CVSS 8.8, while VulDB gives 4.3.
Ubiquiti · airMAX M
Firmware of Ubiquiti airMAX M, LTU PTMP/PTP, SolarPoint and SolarSwitch devices contains a heap-based buffer overflow (CWE-122). An attacker with access to the adjacent network can exploit it without credentials or user interaction. Successful exploitation allows arbitrary code execution on the device, which can serve as a foothold in the local network or a wireless link.
Ubiquiti · airMAX M, LTU, SolarPoint / SolarSwitch
Ubiquiti airMAX M wireless networking devices contain a stored cross-site scripting (XSS) vulnerability (CWE-79). An attacker with access to the adjacent network can store malicious script on the device, which runs when a user views the affected page, and can use this to escalate privileges on the device. Exploitation requires adjacent-network access and user interaction under certain conditions. The CVSS base score is 8.8 (v3.1), and the NVD record was still awaiting analysis at the time of research.
Ubiquiti · airMAX M
