LiveActive security incident?Get immediate response
CVE Record

CVE-2023-2378: Ubiquiti EdgeRouter X Web Management command injection

A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown function of the component Web Management Interface. This manipulation of the argument suffix-rate-up causes command injection. The attack may be initiated remotely. The exploit has been published and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor position is that post-authentication issues are not accepted as vulnerabilities.

HighCVSS 8.6Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2023-2378 is a reported command injection issue in the Ubiquiti EdgeRouter X web management interface. It could let an authenticated high-privilege user run system commands. The report is disputed: VulDB says existence is doubted, and the vendor position is that post-authentication issues are not accepted as vulnerabilities.

Executive priority

Prioritize if EdgeRouter X manages critical network paths or has web management exposed beyond a tightly controlled admin network. The issue is high severity if real, but business urgency is tempered by high privilege requirements and disputed status. Focus on reducing management-plane exposure immediately.

Technical view

The report affects Ubiquiti EdgeRouter X versions 2.0.9-hotfix.0 through 2.0.9-hotfix.6. VulDB attributes the issue to manipulation of the suffix-rate-up argument in the Web Management Interface, classified under CWE-74 and CWE-77. CVSS v4 is 8.6 with network access, low complexity, and high privileges required.

Likely exposure

Exposure is most relevant where EdgeRouter X web management is reachable by administrators or from broader networks. The source bundle does not support impact to other Ubiquiti products. Because privileges are required, credential compromise, shared admin accounts, or exposed management surfaces increase practical risk.

Exploitation context

VulDB states an exploit has been published and may be used, but the linked GitHub reference is marked as a broken link in the bundle. No CISA KEV listing is provided, and no cited source confirms active exploitation. Treat this as a disputed but potentially serious post-authentication router-management risk.

Researcher notes

Evidence comes mainly from VulDB and CVE records. The report names suffix-rate-up but an unknown affected function. Vendor acceptance is absent, and the source bundle says real existence is doubted. Validate defensively in a controlled lab only; do not assume a vendor patch exists from these sources.

Mitigation direction

  • Do not expose EdgeRouter X web management to the internet.
  • Limit management access to trusted administrative networks or VPN.
  • Review Ubiquiti guidance and firmware notes for an applicable resolution.
  • Remove or rotate unneeded administrator accounts and credentials.
  • Monitor for unexpected configuration changes or administrative sessions.

Validation and detection

  • Inventory Ubiquiti EdgeRouter X devices and firmware versions.
  • Flag versions 2.0.9-hotfix.0 through 2.0.9-hotfix.6.
  • Confirm whether web management is reachable from untrusted networks.
  • Review administrative access logs for unusual sessions or configuration changes.
  • Check vendor and VulDB updates because the vulnerability is disputed.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-74: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · medium confidence lookup

CWE-77: Command execution behavior lookup

Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-2378 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.6 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

4CVSS vectors
7Timeline events
1ADP providers
8Source links

CVSS vector scores

4 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.6CVSS 4.0HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P——VulDB
8.3CVSS 2.0HighAV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR6.410VulDB
7.2CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R1.25.9VulDB
7.2CVSS 3.0HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R1.25.9VulDB

Vulnerability scoring details

Base CVSS 4.0 score

8.6High
CVSS 4.0 vector shape for CVE-2023-2378Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineVulDB

    Advisory disclosed

  2. Source timelineVulDB

    CVE reserved

  3. Source timelineVulDB

    VulDB entry created

  4. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  5. CVE publishedCVE Program

    The CVE record was published.

  6. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

  7. Source timelineVulDB

    VulDB entry last update

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
UbiquitiEdgeRouter X2.0.9-hotfix.0, 2.0.9-hotfix.1, 2.0.9-hotfix.2, 2.0.9-hotfix.3, 2.0.9-hotfix.4, 2.0.9-hotfix.5, 2.0.9-hotfix.6Listed
Weakness

CWE details

CWE-74CWE-77

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.