A heap-based buffer overflow vulnerability exists in the firmware of Ubiquiti’s airMAX M, LTU PTMP, LTU PTP, SolarPoint, and SolarSwitch devices. The flaw arises from unchecked memory operations, allowing an attacker to trigger arbitrary code execution on an affected device. Based on the wording of the advisories, the vulnerability is classified under CWE‑122 – Heap-based Buffer Overflow. If successfully exploited, an attacker could gain full control over the device, altering configuration, intercepting traffic, or using the device as a foothold for broader network compromise.

The affected products are all devices from Ubiquiti Inc. that fall under the airMAX M, LTU PTMP, LTU PTP, SolarPoint, and SolarSwitch categories. No specific firmware versions are disclosed in the current advisory, so the vulnerability may span multiple releases. Administrators should refer to the official Ubiquiti security bulletin (bulletin 071) and compare installed firmware against the latest version listings to confirm whether the device is impacted.

The vulnerability carries a CVSS score of 8.8, placing it in the high severity range and indicating significant potential impact. The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog. The attack vector is inferred to be local or adjacent network access, as the description states a malicious actor with access to the adjacent network can exploit the flaw. This means that any user or service that can reach the device’s management or control interfaces could be a vector. Given the high CVSS rating and the absence of mitigation in the advisory, the risk to organizations that keep these devices on a LAN or without proper isolation is substantial.