CVE-2023-2373

Deeper analysis

CVE-2023-2373 is a command injection vulnerability, tracked as CWE-77, that affects the Web Management Interface component of Ubiquiti EdgeRouter X devices running firmware versions up to and including 2.0.9-hotfix.6. The issue stems from insufficient validation of the ecn-up argument, allowing crafted input to be passed to an underlying system command.

An authenticated attacker with low privileges can trigger the flaw remotely over the network, without requiring user interaction, to execute arbitrary commands on the device. Successful exploitation yields limited but combined effects on confidentiality, integrity, and availability, consistent with the reported CVSS 3.1 base score of 6.3.

A functional proof-of-concept has been published publicly, and the EPSS score has remained steady at 0.1373 with no material upward movement observed after disclosure. The primary references consist of technical write-ups and exploit artifacts hosted on GitHub and VulDB.