CVE-2026-21638

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution…

High · published January 8, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

🚨 This vulnerability in the airMAX Wireless Protocol allows a nearby attacker to execute remote code, like a hacker in your backyard hijacking your smart thermostat! 🔥 Think of it like a sneaky delivery person who misdelivers a package directly to your living room instead of your doorstep, giving them access to your home without a key. If they can communicate with your Wi-Fi, they can take control of anything connected to it! An attacker within Wi-Fi range could potentially control the affected devices, leading to devastating consequences — think altered settings, data breaches, or even complete device failures. This isn't just a nuisance; it opens the door to serious system compromise that could disrupt your operations!

Put simply

Think of it like a sneaky delivery person who misdelivers a package directly to your living room instead of your doorstep, giving them access to your home without a key. If they can communicate with your Wi-Fi, they can take control of anything connected to it! This flaw allows for remote code execution through the airMAX Wireless Protocol, enabling an unauthorized user to execute arbitrary commands on the affected products simply by being in close proximity.

What to do

An attacker within Wi-Fi range could potentially control the affected devices, leading to devastating consequences — think altered settings, data breaches, or even complete device failures. This isn't just a nuisance; it opens the door to serious system compromise that could disrupt your operations! Immediate action is crucial! Update your UBB-XG to Version 1.2.3, your UDB-Pro/UDB-Pro-Sector to Version 1.4.2, and your UBB to Version 3.1.7 or later to patch this vulnerability. Don't delay — make these updates a priority! You've got this! With these updates, you'll have your network locked down in no time. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00432 · 36.5th percentile
Published
2026-01-08T16:14Z
EPSS history
Timeline
  • 08 JAN 16:14Z
    A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution…
    cvelistv5