8.8

CVE-2026-21638

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.


Affected Products:
UBB-XG (Version 1.2.2 and earlier) 
UDB-Pro/UDB-Pro-Sector  (Version 1.4.1 and earlier) 
UBB  (Version 3.1.5 and earlier) 
 
Mitigation:
Update your UBB-XG to Version 1.2.3 or later.
Update your UDB-Pro/UDB-Pro-Sector  to Version 1.4.2 or later.
Update your UBB to Version 3.1.7 or later.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ui ≫ Ubb-xg Firmware Version < 1.2.3
   Ui ≫ Ubb-xg Version-
Ui ≫ Udb-pro Firmware Version < 1.4.2
   Ui ≫ Udb-pro Version-
Ui ≫ Udb-pro-sector Firmware Version < 1.4.2
   Ui ≫ Udb-pro-sector Version-
Ui ≫ Ubb Firmware Version < 3.1.7
   Ui ≫ Ubb Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.12% 0.308
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
support@hackerone.com 8.8 2.8 5.9
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.