{"id":"CVE-2026-116838","kind":"vulnerability","aliases":["CVE-2026-116838"],"related":[],"title":"airMAX M devices: CSRF lets a lured user trigger command injection","description":"A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.","summary":"airMAX M wireless devices have a cross-site request forgery flaw that lets a malicious web page make an authenticated user's browser send requests to the device. The forged requests can execute a command injection on the device, which the sources describe as code execution.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["airmax-m","infrastructure","network-gear","ubiquiti"],"not_affected_if":["no-airmax-m-devices"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-27T01:19:06+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","triaged_at":"2026-10-27T01:36:12+00:00","updated_at":"2026-10-27T01:36:12+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T01:36:12Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"airMAX M devices: CSRF lets a lured user trigger command injection","impact":"high","summary":"airMAX M wireless devices have a cross-site request forgery flaw that lets a malicious web page make an authenticated user's browser send requests to the device. The forged requests can execute a command injection on the device, which the sources describe as code execution.","category":"infrastructure","nicknames":[],"who_cares":["airmax-m","network-gear","ubiquiti"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs commands on the device after luring an admin to a page","analyst_note":"Find the affected firmware versions and the vendor advisory for CVE-2026-116838 in the NVD entry, since the sources give no version or fix.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-airmax-m-devices"],"who_is_affected":"Anyone who runs airMAX M devices and whose administrators browse the web while logged into the device admin interface. The sources do not name affected firmware versions. Teams without airMAX M hardware can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000545,"input_tokens":3289,"output_tokens":432,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116838':14A,17A '-2026':13A,16A 'actor':75C 'airmax':1A,19B,26B,97C 'airmax-m':18B 'authent':46B,79C 'browser':49B 'code':71B 'command':10A,61B,103C 'could':85C 'cross':33B,89C 'cross-sit':32B,88C 'csrf':4A,93C 'cve':12A,15A 'describ':69B 'devic':3A,29B,54B,65B,99C,107C 'execut':59B,72B,101C 'exploit':86C 'flaw':37B 'forg':56B 'forgeri':36B,92C 'found':95C 'gear':24B 'infrastructur':21B 'inject':11A,62B,104C 'let':5A,39B 'lure':7A,77C 'm':2A,20B,27B,98C 'make':44B 'malici':41B,74C,83C 'network':23B 'network-gear':22B 'page':43B,84C 'request':35B,51B,57B,91C 'send':50B 'site':34B,90C 'sourc':68B 'trigger':9A 'ubiqu':25B 'user':8A,47B,80C 'vulner':94C 'web':42B 'wireless':28B","nicknames":[],"mitigations":[],"who_affected":"Anyone who runs airMAX M devices and whose administrators browse the web while logged into the device admin interface. The sources do not name affected firmware versions. Teams without airMAX M hardware can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:19:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"fe490ce8-0395-4072-90d8-2707e1bdf984","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116838","severity":null,"published_at":"2026-10-27T01:19:06+00:00","modified_at":"2026-10-27T01:19:06+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","fetched_at":"2026-10-27T01:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}