PT-2019-7857 · Ubiquiti · Edgemax+1

Csiete · Published 2019-02-12 · Updated 2020-02-13 · CVE-2017-0938

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions airMAX versions prior to 8.3.2 airMAX versions prior to 6.0.7 EdgeMAX versions prior to 1.9.7

Description The issue allows attackers to perform a Denial of Service attack by utilizing the Discovery Protocol in amplification attacks.

Recommendations For airMAX versions prior to 8.3.2, update to version 8.3.2 or later. For airMAX versions prior to 6.0.7, update to version 6.0.7 or later. For EdgeMAX versions prior to 1.9.7, update to version 1.9.7 or later.

Fix

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

CVE-2017-0938

Affected Products

Edgemax

Airmax

References · 5

• https://osv.dev/vulnerability/CVE-2017-0938 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0938 · Security Note
• https://community.ubnt.com/t5/airMAX-Updates-Blog/airOS-v8-3-2-Has-Been-Released/ba-p/2049215 · Vendor Advisory
• https://community.ubnt.com/t5/airMAX-Updates-Blog/airOS-v6-0-7-Has-Been-Released/ba-p/2056522 · Vendor Advisory
• https://hackerone.com/reports/221625 · Note