PT-2023-7474 · Ubiquiti · Ubiquiti Edgerouter X

Leetmoon · Published 2023-03-25 · Updated 2024-08-02 · CVE-2023-1458

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ubiquiti EdgeRouter X version 2.0.9-hotfix.6

Description A critical issue has been found in the OSPF Handler component of the software, potentially allowing for command injection through the manipulation of the argument area. This can be exploited remotely. The existence of this issue is still uncertain.

Recommendations For version 2.0.9-hotfix.6, consider restricting access to the OSPF Handler component until a fix is available. As a temporary workaround, avoid using the argument area in the OSPF Handler component to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-08518

CVE-2023-1458

Affected Products

Ubiquiti Edgerouter X

References · 9

• 🔥 https://vuldb.com/?id.223303 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-1458 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1458 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08518 · Security Note
• https://vuldb.com/?ctiid.223303 · Note
• https://github.com/advisories/GHSA-rww4-35wv-xmr3 · Note
• https://t.me/cvenotify/46870 · Telegram Post
• https://t.me/cvenotify/88457 · Telegram Post
• https://twitter.com/underlinux/status/1695217324469391544 · Twitter Post