Ubiquiti airMAX M, LTU, SolarPoint: Heap-based buffer overflow in firmware
Summary
Firmware of Ubiquiti airMAX M, LTU PTMP/PTP, SolarPoint and SolarSwitch devices contains a heap-based buffer overflow (CWE-122). An attacker with access to the adjacent network can exploit it without credentials or user interaction. Successful exploitation allows arbitrary code execution on the device, which can serve as a foothold in the local network or a wireless link.
Affected
- airMAX M: 6.3.24 and earlier
- LTU PTMP: 2.4.1 and earlier
- LTU PTP: 1.5.6 and earlier
- SolarPoint / SolarSwitch: 2.0.2 and earlier
Fixed in
- airMAX M: 6.3.26 or later
- LTU PTMP: 2.4.2 or later
- LTU PTP: 1.5.7 or later
- SolarPoint / SolarSwitch: 2.0.3 or later
Workaround
Unknown. Ubiquiti only offers the firmware update; no vendor workaround is known.
Exploitation
- No evidence of exploitation in the wild as of 31 Oct 2026.
- Not listed in CISA KEV.
- No public proof of concept known.
- EPSS: 0.21 %.
Our recommendation
- Update all affected devices to the fixed firmware versions listed above.
- Check the firmware version of every device, including devices in shared or guest networks.
- Restrict access to the management and adjacent networks until the update is applied.
- Monitor the Ubiquiti advisory for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Ubiquiti Security Advisory Bulletin 071 uisp.community.ui.com
- Faraday Security research write-up faradaysec.com
- ACN: Ubiquiti products vulnerabilities fixed www.acn.gov.it
- OpenCVE: CVE-2026-116837 app.opencve.io
- OffSeq Radar: CVE-2026-116837 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:17.
Original description (NVD)
A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.