CVE-2023-2377
A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (7.62%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The impacted element is an unknown function of the component Web Management Interface. The manipulation of the argument Name results in command injection. The attack can be launched remotely. The exploit is now public and may be used. There is ongoing doubt regarding the real existence of this vulnerability. The vendor position is that post-authentication issues are not accepted as vulnerabilities.
- CVSS 4.0
- 7.3 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 7.62% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74, CWE-77
- Affected
- ui/er-x firmware · ui/er-x-sfp firmware
- Source
- cna@vuldb.com
References
- https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/9Exploit, Third Party Advisory
- https://vuldb.com/cve/CVE-2023-2377
- https://vuldb.com/submit/114081
- https://vuldb.com/vuln/227653
- https://vuldb.com/vuln/227653/cti
- https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/9Exploit, Third Party Advisory
- https://vuldb.com/?ctiid.227653Third Party Advisory
- https://vuldb.com/?id.227653Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.