CVE-2023-1458

Deeper analysis

CVE-2023-1458 is a command-injection vulnerability affecting the OSPF Handler component in Ubiquiti EdgeRouter X firmware version 2.0.9-hotfix.6. The flaw resides in the handling of the “area” argument and is tracked as CWE-77; it received a CVSS 3.1 score of 7.2 reflecting network attack vector, low complexity, and high-privileged authentication requirements.

An authenticated remote attacker who can supply a crafted “area” value can execute arbitrary operating-system commands on the device, resulting in full confidentiality, integrity, and availability impact. Public exploit code has been disclosed, although the vulnerability’s real-world existence remains disputed and the vendor maintains that post-authentication issues are outside its vulnerability-handling policy.

EPSS for the CVE has remained flat at 0.0862 with no material increase since disclosure, indicating limited observed exploitation interest to date. The primary references are Vuldb entries that reiterate the vendor’s stance and do not describe official patches or configuration work-arounds.