Live › vulnerability › CVE-2026-119249
WiFiman Desktop for macOS binds a service to an unrestricted IP address, so someone on the same network can reach it and read information about the Mac. Fixed in 1.3.0. CVSS 7.5 (AV:N/PR:N/UI:N, confidentiality high).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 19:26 UTC. All times on this page are UTC.
Any Mac running WiFiman Desktop for macOS older than 1.3.0 (Ubiquiti lists 1.1.3 and earlier; NVD lists everything below 1.3.0) is exposed to someone on the same network, who needs no login to read information about the machine. Check Macs where staff or admins installed WiFiman for network troubleshooting or Teleport. Windows, Linux and iOS builds are not named, and Macs without the app or already on 1.3.0 can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WiFiman Desktop for macOS | vendor | < 1.3.0 | 1.3.0 |
1.3.0 should be updated; Ubiquiti's bulletin lists 1.1.3 and earlier, NVD lists everything below 1.3.0Update WiFiman Desktop for macOS to version 1.3.0 or later (Ubiquiti Security Advisory Bulletin 072).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop for macOS to obtain information about the host device.
This page as .md · .json · in your agent: get_signal("CVE-2026-119249")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.