CVE-2023-23912

The CVE-2023-23912 issue affects Ubiquiti EdgeOS devices (EdgeRouters up to 2.0.9-hotfix.5 and USG up to 4.4.56). The root cause is in the dhcp6c daemon, where insufficient validation of a user-supplied string enables a network-adjacent attacker connected to the WAN to achieve remote code executi...

CVE-2023-2379

CVE-2023-2379 affects Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The Web Service component is vulnerable to remote denial of service; manipulation leads to DoS. The exploit has been disclosed publicly and may be used. Remediation: upgrade to a version later than 2.0.9-hotfix.6 as advised by PT-2...

CVE-2023-2375

CVE-2023-2375 affects Ubiquiti EdgeRouter X up to version 2.0.9-hotfix.6, specifically the Web Management Interface. The vulnerability is a command injection caused by improper handling of the src argument, with remote exploitation possible and public exploit/public disclosure noted. Connected so...

CVE-2019-16889

CVE-2019-16889 affects Ubiquiti EdgeMAX devices prior to firmware 2.0.3, where handling of the beaker.session.id cookie can trigger a denial-of-service (disk consumption). Specifically, a valid length payload (≤ 249 characters) in a sequence of unique session IDs causes creation of *.cache files ...

CVE-2023-2376

CVE-2023-2376 affects Ubiquiti EdgeRouter X (up to 2.0.9-hotfix.6). The Web Management Interface’s dpi argument is exploitable via a remote command-injection vulnerability. The issue is publicly disclosed and affects the affected product as described in multiple sources (NVD, CVE record, etc.). A...

CVE-2023-2374

CVE-2023-2374 affects Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6, specifically the Web Management Interface. The vulnerability arises from manipulation of the ecn-down argument, leading to command injection. The issue can be exploited remotely and the exploit has been disclosed publicly (VDB-2276...

CVE-2023-2378

The CVE-2023-2378 entry concerns Ubiquiti EdgeRouter X Web Management Interface, affected up to version 2.0.9-hotfix.6. The root cause is improper handling of the suffix-rate-up parameter, enabling remote command injection. Documented impact is high: arbitrary commands could be executed on the de...

CVE-2023-2377

The CVE-2023-2377 entry concerns Ubiquiti EdgeRouter X (up to 2.0.9-hotfix.6) with a vulnerability in the Web Management Interface. The issue is triggered by manipulation of the name argument, leading to remote command injection. The vulnerability affects the Web Management Interface component an...