A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.
Affected Products:
UBB-XG (Version 1.2.2 and earlier)
UDB-Pro/UDB-Pro-Sector (Version 1.4.1 and earlier)
UBB (Version 3.1.5 and earlier)
Mitigation:
Update your UBB-XG to Version 1.2.3 or later.
Update your UDB-Pro/UDB-Pro-Sector to Version 1.4.2 or later.
Update your UBB to Version 3.1.7 or later.
References
| Link | Resource |
|---|---|
| https://community.ui.com/releases/Security-Advisory-Bulletin-060-060/cde18da7-2bc4-41bb-a9cc-48a4a4c479c1 | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
History
14 Jan 2026, 21:06
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Ui udb-pro-sector Firmware
Ui udb-pro-sector Ui ubb-xg Firmware Ui udb-pro Firmware Ui ubb Firmware Ui udb-pro Ui Ui ubb Ui ubb-xg |
|
| References | () https://community.ui.com/releases/Security-Advisory-Bulletin-060-060/cde18da7-2bc4-41bb-a9cc-48a4a4c479c1 - Vendor Advisory | |
| CPE | cpe:2.3:h:ui:ubb-xg:-:*:*:*:*:*:*:* cpe:2.3:o:ui:udb-pro_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:ui:ubb-xg_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:ui:udb-pro-sector:-:*:*:*:*:*:*:* cpe:2.3:o:ui:ubb_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:ui:ubb:-:*:*:*:*:*:*:* cpe:2.3:h:ui:udb-pro:-:*:*:*:*:*:*:* cpe:2.3:o:ui:udb-pro-sector_firmware:*:*:*:*:*:*:*:* |
08 Jan 2026, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-08 17:15
Updated : 2026-01-14 21:06
NVD link : CVE-2026-21638
Mitre link : CVE-2026-21638
CVE.ORG link : CVE-2026-21638
JSON object : View
Products Affected
ui
- ubb_firmware
- ubb-xg
- udb-pro_firmware
- ubb-xg_firmware
- udb-pro-sector
- udb-pro
- ubb
- udb-pro-sector_firmware
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')