8.8

CVE-2023-23912

Exploit
A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix delegation set to dhcpv6-stateless or dhcpv6-stateful, allows a malicious actor directly connected to the WAN interface of an affected device to create a remote code execution vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ui ≫ Usg Firmware Version < 4.4.57
   Ui ≫ Usg Version -
Ui ≫ Usg-pro-4 Firmware Version < 4.4.57
   Ui ≫ Usg-pro-4 Version -
Ui ≫ Er-10x Firmware Version < 2.0.9
   Ui ≫ Er-10x Version -
Ui ≫ Er-10x Firmware Version 2.0.9 Update -
   Ui ≫ Er-10x Version -
Ui ≫ Er-10x Firmware Version 2.0.9 Update hotfix2
   Ui ≫ Er-10x Version -
Ui ≫ Er-10x Firmware Version 2.0.9 Update hotfix4
   Ui ≫ Er-10x Version -
Ui ≫ Er-10x Firmware Version 2.0.9 Update hotfix5
   Ui ≫ Er-10x Version -
Ui ≫ Er-12 Firmware Version < 2.0.9
   Ui ≫ Er-12 Version -
Ui ≫ Er-12 Firmware Version 2.0.9 Update -
   Ui ≫ Er-12 Version -
Ui ≫ Er-12 Firmware Version 2.0.9 Update hotfix2
   Ui ≫ Er-12 Version -
Ui ≫ Er-12 Firmware Version 2.0.9 Update hotfix4
   Ui ≫ Er-12 Version -
Ui ≫ Er-12 Firmware Version 2.0.9 Update hotfix5
   Ui ≫ Er-12 Version -
Ui ≫ Er-12p Firmware Version < 2.0.9
   Ui ≫ Er-12p Version -
Ui ≫ Er-12p Firmware Version 2.0.9 Update -
   Ui ≫ Er-12p Version -
Ui ≫ Er-12p Firmware Version 2.0.9 Update hotfix2
   Ui ≫ Er-12p Version -
Ui ≫ Er-12p Firmware Version 2.0.9 Update hotfix4
   Ui ≫ Er-12p Version -
Ui ≫ Er-12p Firmware Version 2.0.9 Update hotfix5
   Ui ≫ Er-12p Version -
Ui ≫ Er-4 Firmware Version < 2.0.9
   Ui ≫ Er-4 Version -
Ui ≫ Er-4 Firmware Version 2.0.9 Update -
   Ui ≫ Er-4 Version -
Ui ≫ Er-4 Firmware Version 2.0.9 Update hotfix2
   Ui ≫ Er-4 Version -
Ui ≫ Er-4 Firmware Version 2.0.9 Update hotfix4
   Ui ≫ Er-4 Version -
Ui ≫ Er-4 Firmware Version 2.0.9 Update hotfix5
   Ui ≫ Er-4 Version -
Ui ≫ Er-6p Firmware Version < 2.0.9
   Ui ≫ Er-6p Version -
Ui ≫ Er-6p Firmware Version 2.0.9 Update -
   Ui ≫ Er-6p Version -
Ui ≫ Er-6p Firmware Version 2.0.9 Update hotfix2
   Ui ≫ Er-6p Version -
Ui ≫ Er-6p Firmware Version 2.0.9 Update hotfix4
   Ui ≫ Er-6p Version -
Ui ≫ Er-6p Firmware Version 2.0.9 Update hotfix5
   Ui ≫ Er-6p Version -
Ui ≫ Er-8-xg Firmware Version < 2.0.9
   Ui ≫ Er-8-xg Version -
Ui ≫ Er-8-xg Firmware Version 2.0.9 Update -
   Ui ≫ Er-8-xg Version -
Ui ≫ Er-8-xg Firmware Version 2.0.9 Update hotfix2
   Ui ≫ Er-8-xg Version -
Ui ≫ Er-8-xg Firmware Version 2.0.9 Update hotfix4
   Ui ≫ Er-8-xg Version -
Ui ≫ Er-8-xg Firmware Version 2.0.9 Update hotfix5
   Ui ≫ Er-8-xg Version -
Ui ≫ Er-x Firmware Version < 2.0.9
   Ui ≫ Er-x Version -
Ui ≫ Er-x Firmware Version 2.0.9 Update -
   Ui ≫ Er-x Version -
Ui ≫ Er-x Firmware Version 2.0.9 Update hotfix2
   Ui ≫ Er-x Version -
Ui ≫ Er-x Firmware Version 2.0.9 Update hotfix4
   Ui ≫ Er-x Version -
Ui ≫ Er-x Firmware Version 2.0.9 Update hotfix5
   Ui ≫ Er-x Version -
Ui ≫ Er-x-sfp Firmware Version < 2.0.9
   Ui ≫ Er-x-sfp Version -
Ui ≫ Er-x-sfp Firmware Version 2.0.9 Update -
   Ui ≫ Er-x-sfp Version -
Ui ≫ Er-x-sfp Firmware Version 2.0.9 Update hotfix2
   Ui ≫ Er-x-sfp Version -
Ui ≫ Er-x-sfp Firmware Version 2.0.9 Update hotfix4
   Ui ≫ Er-x-sfp Version -
Ui ≫ Er-x-sfp Firmware Version 2.0.9 Update hotfix5
   Ui ≫ Er-x-sfp Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.89% 0.546
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADP 8.8 2.8 5.9
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

The product does not adequately filter user-controlled input for special elements with control implications.

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

https://community.ui.com/releases/Security-Advisory-Bulletin-028-028/696e4e3b-718c-4da4-9a21-965a85633b5f
Patch
Vendor Advisory
Exploit