TI-2026-17430 Aliases CVE-2026-21638 GHSA-m92x-4jg5-v4px

Command injection in Ubiquiti UBB-XG

MEDIUM 40CWE-77Published 2026-01-08 · Updated 2026-02-26

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product. Affected Products: UBB-XG (Version 1.2.2 and earlier) UDB-Pro/UDB-Pro-Sector (Version 1.4.1 and earlier) UBB (Version 3.1.5 and earlier) Mitigation: Update your UBB-XG to Version 1.2.3 or later. Update your UDB-Pro/UDB-Pro-Sector to Version 1.4.2 or later. Update your UBB to Version 3.1.7 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00432 37th percentileScored 2026-11-07

Fix Fixed UBB-XG (Ubiquiti Inc): 1.2.3UDB-Pro/UDB-Pro-Sector (Ubiquiti Inc): 1.4.2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Ubiquiti	UBB-XG	before 1.2.3	1.2.3	Patch available	CNA
Ubiquiti	UDB-Pro/UDB-Pro-Sector	before 1.4.2	1.4.2	Patch available	CNA
Ubiquiti	UBB	before 3.1.7	3.1.7	Patch available	CNA

UBB-XG VendorUbiquiti Affected before 1.2.3 Fixed in 1.2.3 Patch available CNA
UDB-Pro/UDB-Pro-Sector VendorUbiquiti Affected before 1.4.2 Fixed in 1.4.2 Patch available CNA
UBB VendorUbiquiti Affected before 3.1.7 Fixed in 3.1.7 Patch available CNA

CPE configurations NVD · 8

CPE	Versions	Role	Vendor
cpe:2.3:o:ui:ubb-xg_firmware::::::::	before 1.2.3	Vulnerable	Ubiquiti
cpe:2.3:h:ui:ubb-xg:-:::::::*	not specified by NVD	Running on	Ubiquiti
cpe:2.3:o:ui:udb-pro_firmware::::::::	before 1.4.2	Vulnerable	Ubiquiti
cpe:2.3:h:ui:udb-pro:-:::::::*	not specified by NVD	Running on	Ubiquiti
cpe:2.3:o:ui:udb-pro-sector_firmware::::::::	before 1.4.2	Vulnerable	Ubiquiti
cpe:2.3:h:ui:udb-pro-sector:-:::::::*	not specified by NVD	Running on	Ubiquiti
cpe:2.3:o:ui:ubb_firmware::::::::	before 3.1.7	Vulnerable	Ubiquiti
cpe:2.3:h:ui:ubb:-:::::::*	not specified by NVD	Running on	Ubiquiti

cpe:2.3:o:ui:ubb-xg_firmware:*:*:*:*:*:*:*:* Versions before 1.2.3 Vulnerable ·Ubiquiti
cpe:2.3:h:ui:ubb-xg:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
cpe:2.3:o:ui:udb-pro_firmware:*:*:*:*:*:*:*:* Versions before 1.4.2 Vulnerable ·Ubiquiti
cpe:2.3:h:ui:udb-pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
cpe:2.3:o:ui:udb-pro-sector_firmware:*:*:*:*:*:*:*:* Versions before 1.4.2 Vulnerable ·Ubiquiti
cpe:2.3:h:ui:udb-pro-sector:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti
cpe:2.3:o:ui:ubb_firmware:*:*:*:*:*:*:*:* Versions before 3.1.7 Vulnerable ·Ubiquiti
cpe:2.3:h:ui:ubb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ubiquiti

Remediation

Fix · CNA UBB-XG (Ubiquiti Inc) Fixed in 1.2.3
Fix · CNA UDB-Pro/UDB-Pro-Sector (Ubiquiti Inc) Fixed in 1.4.2
Fix · CNA UBB (Ubiquiti Inc) Fixed in 3.1.7

Timeline

2026-10-02 Threatist record created from CVE-2026-21638
2026-10-03 Alias added: GHSA-m92x-4jg5-v4px

References

Advisory 1

https://community.ui.com/releases/Security-Advisory-Bulletin-060-060/cde18da7-2bc4-41bb-a9cc-48a4a4c479c1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences