CVE-2026-21635
📋 TL;DR
An improper access control vulnerability in EV Station Lite (v1.5.2 and earlier) allows attackers within Wi-Fi range to use the WiFi AutoLink feature on devices that were only adopted via Ethernet. This bypasses intended security controls and could allow unauthorized access to charging station management functions. Only EV Station Lite devices running vulnerable firmware are affected.
💻 Affected Systems
- Ubiquiti EV Station Lite
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could gain unauthorized administrative access to the charging station, potentially disrupting charging operations, manipulating settings, or accessing connected vehicle data.
Likely Case
An attacker could connect to the station's management interface without proper authentication, potentially viewing configuration data or making limited unauthorized changes.
If Mitigated
With proper network segmentation and physical security controls, the impact would be limited to local network access only.
🎯 Exploit Status
Exploitation requires physical proximity to the target device's Wi-Fi signal. No authentication is required to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.5.3 or later
Vendor Advisory: https://community.ui.com/releases/Security-Advisory-Bulletin-059/0c0b7f7a-68b7-41b9-987e-554f4b40e0e6
Restart Required: Yes
Instructions:
1. Log into the EV Station management interface. 2. Navigate to Settings > Firmware Update. 3. Check for and install firmware version 1.5.3 or later. 4. Reboot the station after update completes.
🔧 Temporary Workarounds
Disable Wi-Fi AutoLink
allDisable the Wi-Fi AutoLink feature on affected stations
Physical Security Controls
allRestrict physical access to charging station locations to prevent attackers from getting within Wi-Fi range
🧯 If You Can't Patch
- Disable Wi-Fi functionality entirely and use Ethernet-only connections
- Implement strict physical security controls around charging station locations
🔍 How to Verify
Check if Vulnerable:
Check firmware version in EV Station management interface under Settings > About. If version is 1.5.2 or earlier, the device is vulnerable.Check Version:
No CLI command available. Check via web interface at Settings > About.Verify Fix Applied:
Verify firmware version is 1.5.3 or later in Settings > About. Test Wi-Fi AutoLink functionality from an unauthorized device to confirm it no longer works.📡 Detection & Monitoring
Log Indicators:
- Unauthorized Wi-Fi connection attempts
- Unexpected device adoption events
- Wi-Fi AutoLink activation from unknown MAC addresses
Network Indicators:
- Unexpected Wi-Fi connections to EV Station SSID
- Network traffic from EV Station to unauthorized IPs
SIEM Query:
source="ev-station-logs" AND (event="wifi_autolink" OR event="unauthorized_connection")