CVE-2023-2373 in EdgeRouter X
Summary
by MITRE • 04/28/2023
A vulnerability was identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This vulnerability affects unknown code of the component Web Management Interface. Such manipulation of the argument ecn-up leads to command injection. The attack may be performed from remote. The exploit is publicly available and might be used. The actual existence of this vulnerability is currently in question. The vendor position is that post-authentication issues are not accepted as vulnerabilities.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/09/2026
The vulnerability identified as CVE-2023-2373 represents a critical command injection flaw within the web management interface of Ubiquiti EdgeRouter X devices running firmware versions up to 2.0.9-hotfix.6. This security weakness resides in the handling of the ecn-up parameter, which allows attackers to execute arbitrary commands on the affected device through remote exploitation. The vulnerability's classification as critical stems from its potential to provide full system compromise and the public availability of exploitation methods, making it a significant threat to network infrastructure security. The affected component falls under the broader category of web application security flaws that can lead to complete system control.
The technical implementation of this command injection vulnerability occurs through the manipulation of the ecn-up argument within the web management interface of the EdgeRouter X. When an attacker submits malicious input through this parameter, the system fails to properly sanitize or validate the input before processing it, allowing arbitrary command execution. This flaw enables attackers to execute system commands with the privileges of the web application, typically resulting in root-level access to the device. The vulnerability's remote exploitability means that attackers do not require physical access or local network presence to carry out attacks, significantly expanding the attack surface. The flaw demonstrates poor input validation practices and inadequate sanitization of user-supplied data within the web interface components.
The operational impact of this vulnerability extends beyond simple device compromise, as it provides attackers with complete control over the affected EdgeRouter X systems. Once exploited, attackers can modify network configurations, establish persistent backdoors, monitor network traffic, and potentially use the compromised device as a pivot point for attacking other systems within the network. The vulnerability affects enterprise and small business networks that rely on Ubiquiti routers for their networking infrastructure, potentially leading to widespread security breaches. The public disclosure of exploit code increases the likelihood of automated attacks and makes this vulnerability particularly dangerous in environments where network security monitoring may not detect unusual command execution patterns. The compromised device can serve as a persistent threat vector for extended periods without detection.
Organizations should immediately implement mitigations including firmware updates to the latest available versions that address this vulnerability, as Ubiquiti has released patches to resolve the issue. Network segmentation and access controls should be strengthened to limit access to the web management interface, while implementing network monitoring solutions that can detect unusual command execution patterns. The vulnerability aligns with CWE-77 and CWE-78 categories related to command injection flaws, and maps to ATT&CK techniques such as T1059 for command and scripting interpreter and T1566 for spearphishing attachments, highlighting the broader attack surface implications. Additionally, organizations should conduct comprehensive vulnerability assessments of their network infrastructure to identify any other devices running affected firmware versions and ensure that all management interfaces are properly secured with strong authentication mechanisms and access controls.