CVE-2017-0938

published 2019-02-12

CVE-2017-0938: Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks.

Priority P2 71 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

ITW VulnCheck KEV

Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
ui	airos	< 6.0.7	6.0.7
ui	airos	>= 6.0.7 < 8.3.2	8.3.2
ui	edgemax_firmware	< 1.9.7	1.9.7

Detection & IOCs extracted from sources · hover to see the quote

port UDP/10001↗

port UDP/7004↗

• → Monitor for UDP traffic on ports 10001 and 7004 directed at Ubiquiti devices (airMAX / EdgeMAX); unexpected high-volume responses may indicate abuse of the Discovery Protocol for amplification attacks. ↗
• → Detect use of the Ubiquiti Discovery Protocol as an amplification vector; unsolicited discovery responses leaking platform names and IP addresses indicate active exploitation. ↗

• · Vulnerable firmware versions: airMAX below 8.3.2, airMAX below 6.0.7, and EdgeMAX below 1.9.7 are affected; devices running these versions with UDP 10001/7004 exposed are exploitable. ↗
• · Exposure of UDP ports 10001 and 7004 to the internet on Ubiquiti devices enables both amplification DDoS and unauthorized disclosure of sensitive device metadata (platform names, IP addresses). ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:N/A:P

vulncheck 7.5 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-400 CWE-20