CVE-2023-2378
HighCVSS 7.2Exploitation Probability (EPSS)
Very high risk90th percentile - higher than 90% of all known CVEs
Summary
A command injection vulnerability has been found in the Web Management Interface of Ubiquiti EdgeRouter X up to version 2.0.9-hotfix.6. The attack is initiated remotely by manipulating the suffix-rate-up argument. The vendor disputes the issue, stating post-authentication problems are not vulnerabilities.
Risk Assessment
Remote exploitation could allow arbitrary command execution, leading to full device compromise and potential network takeover.
Recommendation
Restrict management interface access to trusted networks and enforce strong authentication. Monitor for vendor updates and consider hardware upgrade.
Original NVD description (English source)
A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown function of the component Web Management Interface. This manipulation of the argument suffix-rate-up causes command injection. The attack may be initiated remotely. The exploit has been published and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor position is that post-authentication issues are not accepted as vulnerabilities.