cbcvebase.
CVE-2023-2378
published 2023-04-28

CVE-2023-2378: A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown function of the component Web Management Interface. This…

PriorityP266high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
7.62%
94.4th percentile
A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown function of the component Web Management Interface. This manipulation of the argument suffix-rate-up causes command injection. The attack may be initiated remotely. The exploit has been published and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor position is that post-authentication issues are not accepted as vulnerabilities.

Affected

21 ranges
VendorProductVersion rangeFixed in
ubiquitiedgerouter_x——
ubiquitiedgerouter_x——
ubiquitiedgerouter_x——
ubiquitiedgerouter_x——
ubiquitiedgerouter_x——
ubiquitiedgerouter_x——
ubiquitiedgerouter_x——
uier-x-sfp_firmware< 2.0.92.0.9
uier-x-sfp_firmware——
uier-x-sfp_firmware——
uier-x-sfp_firmware——
uier-x-sfp_firmware——
uier-x-sfp_firmware——
uier-x-sfp_firmware——
uier-x_firmware< 2.0.92.0.9
uier-x_firmware——
uier-x_firmware——
uier-x_firmware——
uier-x_firmware——
uier-x_firmware——
uier-x_firmware——

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.3HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.08.3HIGHAV:N/AC:L/Au:M/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.