A buffer overflow flaw exists in the DHCPv6 implementation of Ubiquiti EdgeMAX EdgeSwitch devices that can be triggered by a malicious actor with access to the adjacent network. Exploitation leads to remote code execution on the switch, compromising confidentiality, integrity, and availability of the device and potentially the entire network it serves. The weakness is classified as CWE‑122. This vulnerability carries a CVSS score of 8.8, indicating extremely high severity.

The affected product is Ubiquiti EdgeMAX EdgeSwitch with DHCPv6 enabled. No specific firmware versions are listed as vulnerable, so all firmware that supports DHCPv6 on these devices should be considered at risk.

The likely attack vector is an attacker with access to an adjacent network segment that can communicate with the switch’s DHCPv6 service. The EPSS score is less than 1%, indicating a very low probability of exploitation, yet the CVSS 8.8 score signals high severity. The vulnerability is not listed in the CISA KEV catalog. No patch has been publicly released at the time of this analysis, so environments that rely on DHCPv6 on EdgeMAX should consider disabling the service or applying other mitigations.