CVE-2026-77532 Overview
CVE-2026-77532 is a heap-based buffer overflow [CWE-122] in the DHCPv6 handling code of Ubiquiti EdgeMAX EdgeSwitch devices. An attacker on an adjacent network can send crafted DHCPv6 traffic to trigger memory corruption and achieve remote code execution on the switch. No authentication or user interaction is required, and successful exploitation changes the security scope of the affected device.
Critical Impact
Unauthenticated attackers on the local link can execute arbitrary code on DHCPv6-enabled EdgeSwitch devices, granting full control over Layer 2/3 network infrastructure.
Affected Products
- Ubiquiti EdgeMAX EdgeSwitch (DHCPv6-enabled configurations)
- EdgeSwitch firmware versions prior to the fixed release referenced in Ubiquiti Security Advisory Bulletin 068
- Any EdgeSwitch deployment where DHCPv6 client or relay functionality is active
Discovery Timeline
- 2026-08-26 - CVE-2026-77532 published to NVD
- 2026-08-26 - Last updated in NVD database
- Vendor advisory: UI Community Security Advisory Bulletin 068
Technical Details for CVE-2026-77532
Vulnerability Analysis
The vulnerability resides in the DHCPv6 processing logic on EdgeMAX EdgeSwitch devices. The DHCPv6 parser fails to properly validate the length of attacker-controlled fields before copying data into a heap-allocated buffer. This condition allows an adjacent-network attacker to overflow heap memory and corrupt adjacent control structures. Because the DHCPv6 service runs with elevated privileges on the switch, memory corruption can be leveraged to execute arbitrary code with system-level access.
The scope change indicates that exploitation compromises resources beyond the vulnerable component itself. An attacker who gains code execution on an EdgeSwitch can pivot into VLAN traffic, manipulate routing decisions, and intercept or redirect traffic across the broader network segment.
Root Cause
The root cause is improper bounds checking during DHCPv6 message parsing, classified as [CWE-122] Heap-based Buffer Overflow. Length or option fields inside a DHCPv6 packet are trusted without validation, and a subsequent copy operation writes past the allocated buffer boundary.
Attack Vector
Exploitation requires the attacker to be positioned on the same broadcast domain or IPv6 link-local segment as the target switch. DHCPv6 messages travel over UDP port 546/547 using multicast addresses reachable only within the local link, which constrains the attack to adjacent-network positioning. A malicious host, compromised endpoint, or rogue device on any switch port with DHCPv6 enabled can send the crafted packet to trigger the overflow.
No verified proof-of-concept has been published. Refer to the UI Community Security Advisory Bulletin 068 for vendor-supplied technical detail.
Detection Methods for CVE-2026-77532
Indicators of Compromise
- Unexpected DHCPv6 Solicit, Advertise, or Relay-Forward messages containing oversized options or malformed length fields on switch management interfaces.
- Unplanned reboots, watchdog resets, or crash logs from EdgeSwitch devices coinciding with DHCPv6 traffic bursts.
- New outbound connections initiated by the switch management plane to unfamiliar hosts.
Detection Strategies
- Inspect DHCPv6 traffic on ports 546 and 547 for malformed option lengths and abnormally large payloads using network intrusion detection signatures.
- Correlate switch syslog crash reports with adjacent-network DHCPv6 activity in a centralized logging pipeline.
- Baseline legitimate DHCPv6 clients and relays, and alert on new sources emitting DHCPv6 traffic toward EdgeSwitch devices.
Monitoring Recommendations
- Forward EdgeSwitch syslog to a SIEM and alert on process crashes, DHCPv6 parser errors, and configuration changes.
- Monitor Layer 2 telemetry (MAC changes, port flaps, ARP/NDP anomalies) that may indicate post-exploitation activity on a compromised switch.
- Enable IPv6 first-hop security features such as DHCPv6 Guard on upstream infrastructure to observe and block rogue DHCPv6 sources.
How to Mitigate CVE-2026-77532
Immediate Actions Required
- Apply the firmware update referenced in UI Community Security Advisory Bulletin 068 to all EdgeMAX EdgeSwitch devices.
- Inventory every EdgeSwitch with DHCPv6 client or relay enabled and prioritize patching devices exposed to untrusted user segments.
- Restrict physical and logical access to switch ports where DHCPv6 is processed until firmware is updated.
Patch Information
Ubiquiti has published guidance and fixed firmware in the UI Community Security Advisory Bulletin 068. Administrators should review the bulletin for the specific fixed firmware version applicable to each EdgeSwitch model and validate the update via the device management interface.
Workarounds
- Disable DHCPv6 client and relay functionality on EdgeSwitch devices where IPv6 address assignment is not required.
- Enforce DHCPv6 Guard or equivalent IPv6 first-hop security on access ports to block untrusted DHCPv6 sources.
- Segment management and user VLANs so that only trusted infrastructure hosts can reach DHCPv6 services on the switch.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
