PT-2026-2073 · Ubiquiti · Ubb+3

Published 2026-01-08 · Updated 2026-05-19 · CVE-2026-21638

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UBB-XG versions 1.2.2 and earlier UDB-Pro/UDB-Pro-Sector versions 1.4.1 and earlier UBB versions 3.1.5 and earlier

Description A malicious actor within Wi-Fi range of the affected product could exploit a flaw in the airMAX Wireless Protocol to achieve remote code execution (RCE) on the affected product.

Recommendations Update UBB-XG to version 1.2.3 or later. Update UDB-Pro/UDB-Pro-Sector to version 1.4.2 or later. Update UBB to version 3.1.7 or later.

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-21638

Affected Products

Ubb

Ubb-Xg

Udb-Pro

Udb-Pro-Sector

References · 8

• https://community.ui.com/releases/Security-Advisory-Bulletin-060-060/cde18da7-2bc4-41bb-a9cc-48a4a4c479c1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21638 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21638 · Security Note
• https://twitter.com/TheHackerWire/status/2009324304924856663 · Twitter Post
• https://twitter.com/vuldb/status/2009648382571323682 · Twitter Post
• https://twitter.com/CveFindCom/status/2009318970994647516 · Twitter Post
• https://twitter.com/CVEnew/status/2009462363809042579 · Twitter Post
• https://twitter.com/router_bugs/status/2056781769886794021 · Twitter Post