CVE-2026-119249

HighCVSS 7.5/10Last modified Oct 31, 2026

Description

A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop to obtain information about the host device.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1327

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Ubiquiti Inc	WiFiman Desktop	< 1.3.0

References

https://community.ui.com/releases/Security-Advisory-Bulletin-072/351a6d54-3ef7-49b4-ac99-b3a5388a9808

Timeline

Published: Oct 29, 2026
Last modified: Oct 31, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-119252.7Tanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Server.CVE-2026-1192507.8A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman CVE-2026-1192516.7A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for CVE-2026-1192595.3The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing i CVE-2026-119267.5IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request res CVE-2026-1192608.8Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via CVE-2026-1192619.6Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potent CVE-2026-1192628.8Out of bounds write in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via CVE-2026-1192639.6Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the s CVE-2026-1192648.8Use after free in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the s CVE-2026-1192658.8Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer p CVE-2026-1192668.8Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer p