CVE-2023-2373

high

Description

A vulnerability was identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This vulnerability affects unknown code of the component Web Management Interface. Such manipulation of the argument ecn-up leads to command injection. The attack may be performed from remote. The exploit is publicly available and might be used. The actual existence of this vulnerability is currently in question. The vendor position is that post-authentication issues are not accepted as vulnerabilities.

References

https://vuldb.com/?id.227649

https://vuldb.com/?ctiid.227649

https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/5

https://vuldb.com/vuln/227649/cti

https://vuldb.com/vuln/227649

https://vuldb.com/submit/114074

https://vuldb.com/cve/CVE-2023-2373

Details

Source: Mitre, NVD

Published: 2023-04-28

Updated: 2026-07-09

Risk Information

CVSS v2

Base Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.2

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 8.6

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.01045