CVE-2023-2378

high

Description

A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown function of the component Web Management Interface. This manipulation of the argument suffix-rate-up causes command injection. The attack may be initiated remotely. The exploit has been published and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor position is that post-authentication issues are not accepted as vulnerabilities.

References

https://vuldb.com/?id.227654

https://vuldb.com/?ctiid.227654

https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/4

https://vuldb.com/vuln/227654/cti

https://vuldb.com/vuln/227654

https://vuldb.com/submit/114072

https://vuldb.com/cve/CVE-2023-2378

Details

Source: Mitre, NVD

Published: 2023-04-28

Updated: 2026-07-09

Risk Information

CVSS v2

Base Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.2

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 8.6

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.01045