cbcvebase.
CVE-2023-2377
published 2023-04-28

CVE-2023-2377: A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The impacted element is an unknown function of the component Web Management…

PriorityP266high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
7.62%
94.4th percentile
A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The impacted element is an unknown function of the component Web Management Interface. The manipulation of the argument Name results in command injection. The attack can be launched remotely. The exploit is now public and may be used. There is ongoing doubt regarding the real existence of this vulnerability. The vendor position is that post-authentication issues are not accepted as vulnerabilities.

Affected

20 ranges
VendorProductVersion rangeFixed in
ubiquitiedgerouter_x——
ubiquitiedgerouter_x——
ubiquitiedgerouter_x——
ubiquitiedgerouter_x——
ubiquitiedgerouter_x——
ubiquitiedgerouter_x——
ubiquitiedgerouter_x——
uier-x-sfp_firmware< 2.0.92.0.9
uier-x-sfp_firmware——
uier-x-sfp_firmware——
uier-x-sfp_firmware——
uier-x-sfp_firmware——
uier-x-sfp_firmware——
uier-x-sfp_firmware——
uier-x_firmware< 2.0.92.0.9
uier-x_firmware——
uier-x_firmware——
uier-x_firmware——
uier-x_firmware——
uier-x_firmware——

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.3HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.08.3HIGHAV:N/AC:L/Au:M/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.