CVE-2017-0938: hackerone airmax, edgemax Uncontrolled Resource Consumption
CVSS: 7.5v3.1HighModified
Published 12-02-2019Last modified 16-09-2024
Vulnerability summary
CVE-2017-0938 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in hackerone airmax, edgemax. EPSS estimates a 20.97% chance of exploitation in the next 30 days, higher than 97.5% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
20.97%
0%100%
High · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 12-02-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks.
CVSS metrics
2 scores · 1 source · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesSingle source
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
20.97%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 20.97% on 18-09-2026
18-09-202618-10-2026
EPSS score20.97%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Ui2 products
- airos< 6.0.7 | ≥ 6.0.7, < 8.3.2
- edgemax_firmware< 1.9.7
Hackerone1 product
- airmax, edgemaxairMAX < 8.3.2, airMAX < 6.0.7, EdgeRouter < v1.9.7
2 vendors · 3 products
References
3 links- community.ubnt.com/t5/airMAX-Updates-Blog/airOS-v6-0-7-Has-Been-Released/ba-p/2056522X Refsource MISCRelease NotesVendor Advisory
- community.ubnt.com/t5/airMAX-Updates-Blog/airOS-v8-3-2-Has-Been-Released/ba-p/2049215X Refsource MISCRelease NotesVendor Advisory