CVE-2023-2375

Deeper analysis

A vulnerability classified as critical exists in the Web Management Interface component of Ubiquiti EdgeRouter X devices up to version 2.0.9-hotfix.6. The issue stems from improper handling of the src argument, enabling command injection as indicated by CWE-77. The flaw received a CVSS 3.1 score of 6.3 reflecting network attack vector, low attack complexity, and low privileges required without user interaction.

An authenticated remote attacker can supply a crafted src value to execute arbitrary commands on the device. Successful exploitation yields limited read, write, and impact on availability within the affected system. Public proof-of-concept code has been released that demonstrates the injection technique.

The associated EPSS score remains flat at 0.076 with no material increase after disclosure. References point to public exploit repositories and vulnerability databases but contain no details on vendor patches or official mitigation steps.