A vulnerability was found in Ubiquiti Networks EdgeSwitch X up to 1.1.0. It has been declared as critical. Affected by this vulnerability is an unknown code of the component SSH CLI Interface. The manipulation with an unknown input leads to a command injection vulnerability. The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, a privileged user can execute arbitrary shell commands over the SSH CLI interface. This allows to execute shell commands under the root user.

The bug was discovered 03/27/2019. The weakness was presented 04/10/2019 (Website). The advisory is shared at community.ubnt.com. This vulnerability is known as CVE-2019-5424 since 01/04/2019. The attack can be launched remotely. A single authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 14 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See 133334 and 133335 for similar entries.

Productinfo

Vendor

• Ubiquiti

Name

• Networks EdgeSwitch X

Version

• 1.0
• 1.1

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion