Faraday Research found a heap-based buffer overflow in the DHCP client of several Ubiquiti network devices. An attacker on the adjacent network can use it to run arbitrary code on the device. No account needed. No user interaction needed.
Ubiquiti has shipped fixes for every affected product line. If you run airMAX M, LTU PTMP, LTU PTP or SolarPoint / SolarSwitch gear, update now.
At a glance
- CVE: CVE-2026-116837
- Weakness: CWE-122: Heap-based buffer overflow
- Severity: CVSS v3.1 8.8 (High)
- Component: DHCP client processing
- Attack vector: Adjacent network. No authentication, no user interaction
- Impact: Arbitrary code execution on the device
- Vendor: Ubiquiti
- Discovered by: Gastón Aznarez and Dan Borgogno, Faraday Security
- Report to full fix: 130 days
What we found
The flaw lives in the DHCP client processing of affected devices. It is a heap-based buffer overflow: data written past the bounds of a buffer in heap memory. That is a memory-safety bug, and memory-safety bugs on network edge devices are a direct path to control.
According to Ubiquiti’s public advisory, an attacker with adjacent-network access can exploit this condition to execute arbitrary code on the device. Adjacent means the attacker needs to share the network segment. On wireless backhaul and outdoor links, that bar is lower than it sounds.
Faraday’s research identified the memory-safety issue. We are withholding the detailed exploitability assessment and reproduction material. Patching comes first.
Affected versions and fix
Four Ubiquiti product lines are affected. All four have a fixed release.
- airMAX M: 6.3.24 and earlier are affected. Fixed in 6.3.26 or later.
- LTU PTMP: 2.4.1 and earlier are affected. Fixed in 2.4.2 or later.
- LTU PTP: 1.5.6 and earlier are affected. Fixed in 1.5.7 or later.
- SolarPoint / SolarSwitch: 2.0.2 and earlier are affected. Fixed in 2.0.3 or later.
What to do now
- Inventory every airMAX M, LTU PTMP, LTU PTP and SolarPoint / SolarSwitch device in your environment.
- Check the firmware version on each one against the table above.
- Update anything on an affected version to the fixed release or later.
- Review Ubiquiti’s security advisory for vendor guidance.
Disclosure timeline
130 days from report to fixes for every affected product. We reported through HackerOne and coordinated with Ubiquiti until all patches shipped.
- June 5, 2026 (19:32 UTC): Vulnerability reported to Ubiquiti through HackerOne.
- September 11, 2026: airMAX M 6.3.26 released.
- October 12, 2026: LTU PTMP 2.4.2 and LTU PTP 1.5.7 released.
- October 13, 2026: SolarPoint / SolarSwitch 2.0.3 released. Fixes available for all affected products.
- October 26, 2026: Ubiquiti security advisory published.
- October 27, 2026: CVE-2026-116837 published.
Credits
Discovered by Gastón Aznarez and Dan Borgogno, security researchers at Faraday Security. Thanks to the Ubiquiti security team for the coordinated disclosure.
This is what Faraday Research does: find the flaws before attackers do, report them responsibly, and push until they’re fixed.
AI Runs. We Decide.