Wi-Fi-range remote code execution in Ubiquiti Inc airMAX and airFiber products

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.

• airMAX AC: structured affected data identifies versions less than 8.7.21 as affected; the vendor narrative states 8.7.20 and earlier.
• airMAX M: structured affected data identifies versions less than 6.3.24 as affected, while the narrative description states 6.3.22 and earlier. The status of 6.3.23 is not resolved consistently in the available evidence; treat every version less than 6.3.24 as requiring review.
• airFiber AF60-XG: versions less than 1.2.3 are affected; the vendor narrative states 1.2.2 and earlier.
• airFiber AF60: versions less than 2.6.8 are affected; the vendor narrative states 2.6.7 and earlier.

The record sets the default status to unaffected outside these ranges, but the status of parallel branches or other firmware lines should not be inferred without vendor confirmation.

The affected component is the airMAX Wireless Protocol in firmware for the listed Ubiquiti devices. The record classifies the issue as CWE-120, Classic Buffer Overflow, but does not disclose enough implementation detail to identify the vulnerable parser, function, message type, or data field. The attacker controls protocol data sent to the device, although the specific input format is not disclosed. Reachability is limited to an actor within Wi-Fi range of the product; the record indicates that privileges and user interaction are not required. Successful exploitation could result in remote code execution on the affected device. The available evidence does not establish the payload, internal processing path, or privilege boundary of the executed code.

The vulnerability is reachable over an adjacent network, specifically by an actor within Wi-Fi range of the device. The record describes low attack complexity, no required privileges, and no required user interaction. The supplied data sets public_exploit to false, and does not mark the vulnerability as known exploited. CVE enrichment returned during research records a CISA assessment of exploitation as none and automation as no at that assessment. These statuses do not guarantee that future exploitation will not occur, and the evidence does not identify any compromised devices.

The stated technical outcome is remote code execution on an affected device by an actor within Wi-Fi range. Because the attack does not require privileges or user interaction, equipment deployed where untrusted people can approach may face direct exposure. Code execution could compromise the confidentiality, integrity, or availability of the device and the wireless services it provides. The evidence does not establish the attacker's exact level of control, persistence, or ability to affect other systems because implementation details and the payload are not disclosed.

Successful exploitation could give a nearby actor code execution without requiring authentication. Depending on the execution context, the actor could alter device behavior, access data handled by the device, or disrupt wireless connectivity. Organizations may need emergency firmware maintenance, traffic failover, or a review of wireless links that depend on the affected equipment. The supplied evidence does not identify a specific intrusion, data disclosure, or service outage.

1. Inventory each Ubiquiti device and confirm its product family and installed firmware.
2. Update airMAX AC to 8.7.21, airMAX M to 6.3.24, airFiber AF60-XG to 1.2.3, and airFiber AF60 to 2.6.8. These are the remediation versions stated in the record and vendor description.
3. For airMAX M, treat every version less than 6.3.24 as requiring an update or additional verification because the narrative and structured data do not agree about 6.3.23.
4. If an immediate update is not possible, reduce exposure to untrusted actors within Wi-Fi range as a temporary precaution. This is not a replacement for the vendor fix.
5. After updating, verify the firmware version on each device and review management activity, unexpected reboots, and link disruption. The record does not provide another vendor-supplied mitigation.

1. Inventory Ubiquiti devices in the airMAX AC, airMAX M, airFiber AF60-XG, and airFiber AF60 families, including their installed firmware versions.
2. Compare each version with the affected boundaries in affected_summary, with particular attention to airMAX M devices below 6.3.24.
3. Prioritize devices deployed where untrusted people may approach within Wi-Fi range.
4. Review device telemetry and management logs for unexpected configuration changes, unplanned reboots, or service disruption after possible exposure. These are precautionary monitoring checks, not vendor-published indicators of compromise.
5. The record provides no packet signature, log event, or specific IOC. The absence of these signs does not prove that a device is safe.