CVE-2023-7211
Auth Bypass in Uniwayinfo Uw-302Vp Firmware ≤ 2.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-7211 is a medium-severity Reliance on IP Address for Authentication (CWE-291) vulnerability in Uniwayinfo Uw-302Vp Firmware. Its CVSS base score is 5.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked in the top 40% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-3 (Device Identification and Authentication) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-59392
Vulnerability Data
A vulnerability was found in Uniway Router 2.0. It has been declared as critical. This vulnerability affects unknown code of the component Administrative Web Interface. The manipulation leads to reliance on ip address for authentication. The attack can be initiated…
more
remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-249766 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires unique identification and authentication of users rather than permitting unauthenticated or spoofable attributes such as source IP.
Requires unique identification and authentication of devices before establishing connections, preventing unauthenticated device claims.
Requires unique identification and authentication of non-organizational users, precluding reliance on IP address alone.
Manages authenticators with verification and secure distribution, reducing opportunities for improper authentication.
Mandates documented usage restrictions and configuration requirements for remote access that cannot be satisfied by IP-based authentication.
Enforces access only after approved authorizations, which presupposes correct authentication has occurred.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Network monitoring can detect misuse of IP authentication but does not prevent the weakness.
Managed identities and credentials supplant weak IP-based authentication decisions.
Strong authentication mechanisms directly replace reliance on spoofable IP addresses.
Authorization policies and least privilege reduce dependence on network-location assertions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 only requires defining a topic-specific access control policy and determining requirements; it does not itself enforce, implement or prevent exploitation of IP-based authentication (a technical flaw that can still be exploited even with a policy in place).
A.5.16 manages the lifecycle, uniqueness, and accountability of identities; it has no bearing on whether a product trusts an IP address as an authenticator, so the weakness remains present and exploitable.
Authentication-information rules discourage reliance on mutable attributes such as IP addresses.
A.5.18 governs the provisioning, review, and revocation of access rights granted to already-authenticated identities; it has no bearing on whether an IP address is used as (or in lieu of) an authentication mechanism, so the weakness can still be present and exploited.
A.8.2 controls the allocation, review, expiry and use of privileged rights via authorization and least-privilege rules; it has no bearing on whether a product accepts an IP address as an authenticator, so the weakness can still be present and exploited.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.