CVE-2023-2374

high

Description

A security flaw has been discovered in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This issue affects some unknown processing of the component Web Management Interface. Performing a manipulation of the argument ecn-down results in command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The existence of this vulnerability is still disputed at present. The vendor position is that post-authentication issues are not accepted as vulnerabilities.

References

https://vuldb.com/?id.227650

https://vuldb.com/?ctiid.227650

https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/6

https://vuldb.com/vuln/227650/cti

https://vuldb.com/vuln/227650

https://vuldb.com/submit/114075

https://vuldb.com/cve/CVE-2023-2374

Details

Source: Mitre, NVD

Published: 2023-04-28

Updated: 2026-07-09

Risk Information

CVSS v2

Base Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.2

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 8.6

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.01146