CVE-2023-2378
This manipulation of the argument suffix-rate-up causes command injection.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (7.62%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown function of the component Web Management Interface. This manipulation of the argument suffix-rate-up causes command injection. The attack may be initiated remotely. The exploit has been published and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor position is that post-authentication issues are not accepted as vulnerabilities.
- CVSS 4.0
- 7.3 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 7.62% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74, CWE-77
- Affected
- ui/er-x firmware · ui/er-x-sfp firmware
- Source
- cna@vuldb.com
References
- https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/4Exploit, Third Party Advisory
- https://vuldb.com/cve/CVE-2023-2378
- https://vuldb.com/submit/114072
- https://vuldb.com/vuln/227654
- https://vuldb.com/vuln/227654/cti
- https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/4Exploit, Third Party Advisory
- https://vuldb.com/?ctiid.227654Third Party Advisory
- https://vuldb.com/?id.227654Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.