PT-2018-5160 · Ubiquiti Networks · Edgeos

Published 2018-03-22 · Updated 2019-10-09 · CVE-2017-0933

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ubiquiti Networks EdgeOS versions 1.9.1 and prior

Description The issue allows an attacker with access to an operator account to potentially gain admin privileges by luring an admin user into accessing an attacker-controlled page, exploiting a Cross-Site Request Forgery (CSRF) weakness.

Recommendations For Ubiquiti Networks EdgeOS versions 1.9.1 and prior, update to a version later than 1.9.1 to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-0933

Affected Products

Edgeos

References · 4

• https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-software-release-v1-9-1-1/ba-p/1910524 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0933 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0933 · Vendor Advisory
• https://hackerone.com/reports/240098 · Note