Medium severity · published Jan 5, 2026
CVE-2026-21635
An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink feature on a device that was only adopted…
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink feature on a device that was only adopted via Ethernet.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UC
UniFi Connect EV Station Lite · Ubiquiti Inc
before 1.6.1 · source: vendor
UC
Unifi Connect EV Station Lite Firmware · UI
before 1.6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-21635
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-21635
Vendor Advisory
https://community.ui.com/releases/Security-Advisory-Bulletin-059/0c0b7f7a-68b7-41b9-987e-554f4b40e0e6
More from UniFi Connect EV Station Lite
9.8
CVE-2025-24285
Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with network access to the UniFi Connect EV…