Vulnerability Description
A security flaw has been discovered in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This issue affects some unknown processing of the component Web Management Interface. Performing a manipulation of the argument ecn-down results in command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The existence of this vulnerability is still disputed at present. The vendor position is that post-authentication issues are not accepted as vulnerabilities.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ui | Er-X Firmware | < 2.0.9 |
| Ui | Er-X | - |
| Ui | Er-X-Sfp Firmware | < 2.0.9 |
| Ui | Er-X-Sfp | - |
Related Weaknesses (CWE)
References
- https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/6ExploitThird Party Advisory
- https://vuldb.com/cve/CVE-2023-2374
- https://vuldb.com/submit/114075
- https://vuldb.com/vuln/227650
- https://vuldb.com/vuln/227650/cti
- https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/6ExploitThird Party Advisory
- https://vuldb.com/?ctiid.227650Permissions RequiredThird Party Advisory
- https://vuldb.com/?id.227650Third Party Advisory
FAQ
What is CVE-2023-2374?
CVE-2023-2374 is a vulnerability with a CVSS score of 7.2 (HIGH). A security flaw has been discovered in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This issue affects some unknown processing of the component Web Management Interface. Performing a manipulation of th...
How severe is CVE-2023-2374?
CVE-2023-2374 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-2374?
Check the references section above for vendor advisories and patch information. Affected products include: Ui Er-X Firmware, Ui Er-X, Ui Er-X-Sfp Firmware, Ui Er-X-Sfp.