CVE-2023-2376
A security vulnerability has been detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (7.62%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A security vulnerability has been detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The affected element is an unknown function of the component Web Management Interface. The manipulation of the argument dpi leads to command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. There are still doubts about whether this vulnerability truly exists. The vendor position is that post-authentication issues are not accepted as vulnerabilities.
- CVSS 4.0
- 7.3 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 7.62% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74, CWE-77
- Affected
- ui/er-x firmware · ui/er-x-sfp firmware
- Source
- cna@vuldb.com
References
- https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/8Exploit, Third Party Advisory
- https://vuldb.com/cve/CVE-2023-2376
- https://vuldb.com/submit/114078
- https://vuldb.com/vuln/227652
- https://vuldb.com/vuln/227652/cti
- https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/8Exploit, Third Party Advisory
- https://vuldb.com/?ctiid.227652Third Party Advisory
- https://vuldb.com/?id.227652Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.