Lucene search

VulDBCVE-2023-2373

HistoryApr 28, 2023 - 2:15 p.m.

CVE-2023-2373

2023-04-2814:15:10

CWE-77

VulDB

web.nvd.nist.gov

cve-2023-2373

ubiquiti edgerouter x

vulnerability

critical

web management interface

command injection

remote attack

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

47.2%

JSON

A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown part of the component Web Management Interface. The manipulation of the argument ecn-up leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227649 was assigned to this vulnerability.

Affected configurations

Nvd

Vulners

Node

uiedgemax_edgerouter_firmwareRange<2.0.9

uiedgemax_edgerouter_firmwareMatch2.0.9-

uiedgemax_edgerouter_firmwareMatch2.0.9hotfix1

uiedgemax_edgerouter_firmwareMatch2.0.9hotfix2

uiedgemax_edgerouter_firmwareMatch2.0.9hotfix4

uiedgemax_edgerouter_firmwareMatch2.0.9hotfix5

uiedgemax_edgerouter_firmwareMatch2.0.9hotfix6

AND

uier-xMatch-

uier-x-sfpMatch-

VendorProductVersionCPE
uiedgemax_edgerouter_firmware*cpe:2.3:o:ui:edgemax_edgerouter_firmware:*:*:*:*:*:*:*:*
uiedgemax_edgerouter_firmware2.0.9cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:-:*:*:*:*:*:*
uiedgemax_edgerouter_firmware2.0.9cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:hotfix1:*:*:*:*:*:*
uiedgemax_edgerouter_firmware2.0.9cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:hotfix2:*:*:*:*:*:*
uiedgemax_edgerouter_firmware2.0.9cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:hotfix4:*:*:*:*:*:*
uiedgemax_edgerouter_firmware2.0.9cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:hotfix5:*:*:*:*:*:*
uiedgemax_edgerouter_firmware2.0.9cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:hotfix6:*:*:*:*:*:*
uier-x-cpe:2.3:h:ui:er-x:-:*:*:*:*:*:*:*
uier-x-sfp-cpe:2.3:h:ui:er-x-sfp:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ui	edgemax_edgerouter_firmware	*	cpe:2.3:o:ui:edgemax_edgerouter_firmware::::::::
ui	edgemax_edgerouter_firmware	2.0.9	cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:-::::::
ui	edgemax_edgerouter_firmware	2.0.9	cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:hotfix1::::::
ui	edgemax_edgerouter_firmware	2.0.9	cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:hotfix2::::::
ui	edgemax_edgerouter_firmware	2.0.9	cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:hotfix4::::::
ui	edgemax_edgerouter_firmware	2.0.9	cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:hotfix5::::::
ui	edgemax_edgerouter_firmware	2.0.9	cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:hotfix6::::::
ui	er-x	-	cpe:2.3:h:ui:er-x:-:::::::*
ui	er-x-sfp	-	cpe:2.3:h:ui:er-x-sfp:-:::::::*

CNA Affected

[
  {
    "vendor": "Ubiquiti",
    "product": "EdgeRouter X",
    "versions": [
      {
        "version": "2.0.9-hotfix.0",
        "status": "affected"
      },
      {
        "version": "2.0.9-hotfix.1",
        "status": "affected"
      },
      {
        "version": "2.0.9-hotfix.2",
        "status": "affected"
      },
      {
        "version": "2.0.9-hotfix.3",
        "status": "affected"
      },
      {
        "version": "2.0.9-hotfix.4",
        "status": "affected"
      },
      {
        "version": "2.0.9-hotfix.5",
        "status": "affected"
      },
      {
        "version": "2.0.9-hotfix.6",
        "status": "affected"
      }
    ],
    "modules": [
      "Web Management Interface"
    ]
  }
]

References

github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/5

vuldb.com/?ctiid.227649

vuldb.com/?id.227649

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

47.2%

JSON

Related for CVE-2023-2373