This vulnerability is a Cross‑Site Request Forgery that allows a malicious actor to induce an authenticated user to visit a crafted page. Through the forged request, the attacker can invoke a command‑execution primitive on the airMAX M device, effectively gaining remote code execution capabilities. The core weakness is a lack of proper request validation, permitting unintended command injection.

Affected products belong to Ubiquiti Inc. and include the airMAX M series. No specific firmware or hardware revision numbers are listed in the advisory; therefore, all current airMAX M devices should be examined for a patch or firmware update.

The vulnerability carries a CVSS score of 8.8, indicating high severity. EPSS data is not available, and it is not listed in CISA’s KEV catalog, suggesting no confirmed public exploitation yet. The likelihood of exploitation is inferred to be medium, given that the attack requires the victim to visit a malicious webpage while authenticated, and then relies on the device’s lack of CSRF defenses to trigger the command injection.