A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX

Summary

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.

Remediation

1. Inventory every Ubiquiti Inc airMAX M deployment, including staging.
2. Upgrade Ubiquiti Inc airMAX M to 6.3.26.
3. Confirm the running version after the upgrade.

References

• Referencehttps://uisp.community.ui.com/releases/Security-Advisory-Bulletin-071/7d4d42cf-09e4-44d3-9c19-649cac8c6af3