Vulnerability Description
A vulnerability was identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This vulnerability affects unknown code of the component Web Management Interface. Such manipulation of the argument ecn-up leads to command injection. The attack may be performed from remote. The exploit is publicly available and might be used. The actual existence of this vulnerability is currently in question. The vendor position is that post-authentication issues are not accepted as vulnerabilities.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ui | Edgemax Edgerouter Firmware | < 2.0.9 |
| Ui | Er-X | - |
| Ui | Er-X-Sfp | - |
Related Weaknesses (CWE)
References
- https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/5ExploitThird Party Advisory
- https://vuldb.com/cve/CVE-2023-2373
- https://vuldb.com/submit/114074
- https://vuldb.com/vuln/227649
- https://vuldb.com/vuln/227649/cti
- https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/5ExploitThird Party Advisory
- https://vuldb.com/?ctiid.227649Permissions RequiredThird Party Advisory
- https://vuldb.com/?id.227649Third Party Advisory
FAQ
What is CVE-2023-2373?
CVE-2023-2373 is a vulnerability with a CVSS score of 7.2 (HIGH). A vulnerability was identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This vulnerability affects unknown code of the component Web Management Interface. Such manipulation of the argument ecn-u...
How severe is CVE-2023-2373?
CVE-2023-2373 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-2373?
Check the references section above for vendor advisories and patch information. Affected products include: Ui Edgemax Edgerouter Firmware, Ui Er-X, Ui Er-X-Sfp.