disputed

A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown part of the component Web Management Interface. The manipulation of the argument ecn-up leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227649 was assigned to this vulnerability.

A vulnerability was identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This vulnerability affects unknown code of the component Web Management Interface. Such manipulation of the argument ecn-up leads to command injection. The attack may be performed from remote. The exploit is publicly available and might be used. The actual existence of this vulnerability is currently in question. The vendor position is that post-authentication issues are not accepted as vulnerabilities.

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

(AV:N/AC:L/Au:M/C:C/I:C/A:C)

(AV:N/AC:L/Au:S/C:P/I:P/A:P)

CWE-74

https://vuldb.com/cve/CVE-2023-2373

https://vuldb.com/submit/114074

https://vuldb.com/vuln/227649

https://vuldb.com/vuln/227649/cti

https://vuldb.com/?ctiid.227649

https://vuldb.com/?id.227649

https://vuldb.com/?ctiid.227649 Types: Permissions Required, Third Party Advisory

https://vuldb.com/?id.227649 Types: Third Party Advisory

[{"vendor":"Ubiquiti","product":"EdgeRouter X","modules":["Web Management Interface"],"versions":[{"version":"2.0.9-hotfix.0","status":"affected"},{"version":"2.0.9-hotfix.1","status":"affected"},{"version":"2.0.9-hotfix.2","status":"affected"},{"version":"2.0.9-hotfix.3","status":"affected"},{"version":"2.0.9-hotfix.4","status":"affected"},{"version":"2.0.9-hotfix.5","status":"affected"},{"version":"2.0.9-hotfix.6","status":"affected"}]}]

[{"vendor":"Ubiquiti","product":"EdgeRouter X","cpes":["cpe:2.3:h:ubiquiti:edgerouter_x:*:*:*:*:*:*:*:*"],"modules":["Web Management Interface"],"versions":[{"version":"2.0.9-hotfix.0","status":"affected"},{"version":"2.0.9-hotfix.1","status":"affected"},{"version":"2.0.9-hotfix.2","status":"affected"},{"version":"2.0.9-hotfix.3","status":"affected"},{"version":"2.0.9-hotfix.4","status":"affected"},{"version":"2.0.9-hotfix.5","status":"affected"},{"version":"2.0.9-hotfix.6","status":"affected"}]}]

{"timestamp":"2025-01-30T17:10:08.357924Z","id":"CVE-2023-2373","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Ubiquiti","product":"EdgeRouter X","modules":["Web Management Interface"],"versions":[{"version":"2.0.9-hotfix.0","status":"affected"},{"version":"2.0.9-hotfix.1","status":"affected"},{"version":"2.0.9-hotfix.2","status":"affected"},{"version":"2.0.9-hotfix.3","status":"affected"},{"version":"2.0.9-hotfix.4","status":"affected"},{"version":"2.0.9-hotfix.5","status":"affected"},{"version":"2.0.9-hotfix.6","status":"affected"}]}]

https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/5

https://vuldb.com/?ctiid.227649

https://vuldb.com/?id.227649

VulDB AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

VulDB AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

NIST AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AND
     OR
          *cpe:2.3:o:ui:edgemax_edgerouter_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.0.9
          *cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:-:*:*:*:*:*:*
          *cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:hotfix1:*:*:*:*:*:*
          *cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:hotfix2:*:*:*:*:*:*
          *cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:hotfix4:*:*:*:*:*:*
          *cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:hotfix5:*:*:*:*:*:*
          *cpe:2.3:o:ui:edgemax_edgerouter_firmware:2.0.9:hotfix6:*:*:*:*:*:*
     OR
          cpe:2.3:h:ui:er-x:-:*:*:*:*:*:*:*
          cpe:2.3:h:ui:er-x-sfp:-:*:*:*:*:*:*:*

https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/5 No Types Assigned

https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/5 Exploit, Third Party Advisory

https://vuldb.com/?ctiid.227649 No Types Assigned

https://vuldb.com/?ctiid.227649 Permissions Required, Third Party Advisory

https://vuldb.com/?id.227649 No Types Assigned

https://vuldb.com/?id.227649 Third Party Advisory