CVE-2023-23912: ui er-10x_firmware

Vulnerability summary

CVE-2023-23912 is a high (CVSS 8.8) vulnerability in ui er-10x_firmware. EPSS estimates a 0.96% chance of exploitation in the next 30 days, higher than 60.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-02-2023
   PublishedVulnerability first disclosed.
2. 24-03-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix delegation set to dhcpv6-stateless or dhcpv6-stateful, allows a malicious actor directly connected to the WAN interface of an affected device to create a remote code execution vulnerability.

• CWE-75Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)The product does not adequately filter user-controlled input for special elements with control implications.
• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.