The vulnerability is a stored XSS in Ubiquiti airMAX M devices that, when exploited by a malicious actor with access to the adjacent network and meeting certain conditions, can lead to privilege escalation on the device. The flaw allows an attacker to inject and execute malicious scripts in the device’s web interface, which run with the privileges of the management processes. Because the script executes with elevated permissions, the attacker can gain full control over the device, compromising confidentiality, integrity, and availability.

The affected vendor is Ubiquiti Inc, specifically the airMAX M product line. No specific firmware or hardware revision numbers were supplied in the advisory, so all current airMAX M devices that expose the management interface to an adjacent network should be assumed vulnerable unless a patch has been applied.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, so the likelihood of exploitation is uncertain, yet the flaw requires only local or adjacent‑network access and can execute privileged commands, presenting a serious risk. The vulnerability is not listed in CISA’s KEV catalog, but the absence of official mitigations does not reduce its impact. The likely attack vector is local or adjacent‑network access, with the attacker needing to reach the management interface, supply a crafted payload that will be stored, and have it served to authenticated users. Under the specified conditions the exploit can elevate privileges, allowing complete control of the device.