{"id":"CVE-2026-116839","kind":"vulnerability","aliases":["CVE-2026-116839"],"related":[],"title":"airMAX M devices: cross-site request forgery lets lured users change settings","description":"A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.","summary":"airMAX M wireless devices have a cross-site request forgery flaw: a malicious page visited by a logged-in administrator can send requests that change configuration. An attacker can also use it to cause a denial of service on the device.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["airmax","infrastructure","self-hosted","ubiquiti","wireless"],"not_affected_if":["auth-required"],"how_to_check":"- Identify airMAX M devices on the network and note the firmware version shown in the device web interface\n- unknown","fix":"- Update airMAX M devices to a fixed firmware version (unknown; the sources do not name it)\n- Until patched, log out of device web interfaces after use and avoid browsing untrusted sites while logged in","status":"open","published_at":"2026-10-27T01:19:07+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","triaged_at":"2026-10-27T01:36:20+00:00","updated_at":"2026-10-27T01:36:20+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T01:36:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update airMAX M devices to a fixed firmware version (unknown; the sources do not name it)\n- Until patched, log out of device web interfaces after use and avoid browsing untrusted sites while logged in","reach":"network","title":"airMAX M devices: cross-site request forgery lets lured users change settings","impact":"medium","summary":"airMAX M wireless devices have a cross-site request forgery flaw: a malicious page visited by a logged-in administrator can send requests that change configuration. An attacker can also use it to cause a denial of service on the device.","category":"infrastructure","nicknames":[],"who_cares":["airmax","wireless","ubiquiti","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"unauthorized device configuration changes and denial of service on the device","analyst_note":"Find the NVD entry's affected firmware versions and the vendor advisory with the fixed release.","how_to_check":"- Identify airMAX M devices on the network and note the firmware version shown in the device web interface\n- unknown","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Teams running Ubiquiti airMAX M wireless devices with a logged-in administrator web session. Exposure depends on the user visiting an attacker-controlled page while authenticated; devices managed only through other interfaces or never opened in a browser are less exposed. Exact affected firmware versions are unknown from the sources.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0006,"input_tokens":3306,"output_tokens":539,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116839':16A,19A '-2026':15A,18A 'actor':72C 'administr':48B 'airmax':1A,20B,27B,94C 'also':58B 'attack':56B,108C 'authent':76C 'caus':62B 'chang':12A,53B,100C 'configur':54B 'could':82C 'cross':5A,34B,86C 'cross-sit':4A,33B,85C 'csrf':90C 'cve':14A,17A 'denial':64B,104C 'devic':3A,30B,69B,96C,111C 'dos':107C 'execut':102C 'exploit':83C 'flaw':38B 'forgeri':8A,37B,89C 'found':92C 'host':24B 'infrastructur':21B 'let':9A 'log':46B 'logged-in':45B 'lure':10A,74C 'm':2A,28B,95C 'make':98C 'malici':40B,71C,80C 'page':41B,81C 'request':7A,36B,51B,88C 'self':23B 'self-host':22B 'send':50B 'servic':66B,106C 'set':13A 'site':6A,35B,87C 'ubiqu':25B 'unauthor':99C 'use':59B 'user':11A,77C 'visit':42B 'vulner':91C 'wireless':26B,29B","nicknames":[],"mitigations":[],"who_affected":"Teams running Ubiquiti airMAX M wireless devices with a logged-in administrator web session. Exposure depends on the user visiting an attacker-controlled page while authenticated; devices managed only through other interfaces or never opened in a browser are less exposed. Exact affected firmware versions are unknown from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:19:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cvss_by":"fe490ce8-0395-4072-90d8-2707e1bdf984","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116839","severity":null,"published_at":"2026-10-27T01:19:07+00:00","modified_at":"2026-10-27T01:19:07+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","fetched_at":"2026-10-27T01:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}