CVE-2023-2374 in EdgeRouter X
Summary
by MITRE • 04/28/2023
A security flaw has been discovered in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This issue affects some unknown processing of the component Web Management Interface. Performing a manipulation of the argument ecn-down results in command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The existence of this vulnerability is still disputed at present. The vendor position is that post-authentication issues are not accepted as vulnerabilities.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/09/2026
The vulnerability identified as CVE-2023-2374 represents a critical command injection flaw within the web management interface of Ubiquiti EdgeRouter X devices running firmware versions up to 2.0.9-hotfix.6. This vulnerability specifically targets the ecn-down argument parameter, which when manipulated allows attackers to execute arbitrary commands on the affected device. The flaw exists in the web interface component of the router's management system, making it accessible through standard network protocols and potentially exploitable by remote attackers without requiring physical access or authentication credentials. The discovery of this vulnerability has been documented in VDB-227650, which serves as the official identifier for tracking and mitigation efforts.
The technical nature of this vulnerability aligns with CWE-77 and CWE-94 categories, specifically representing a command injection vulnerability that allows arbitrary code execution through manipulation of input parameters. Attackers can exploit this flaw by crafting malicious requests to the web management interface that include specially formatted ecn-down arguments, which are then processed without proper sanitization or validation. This type of vulnerability falls under the ATT&CK framework category of T1059.001 - Command and Scripting Interpreter, specifically targeting the execution of system commands through web interfaces. The impact is particularly severe because the web management interface is typically accessible over the network, allowing remote exploitation from any location with network connectivity to the device.
The operational impact of CVE-2023-2374 extends beyond simple unauthorized access, as successful exploitation can result in complete system compromise of the affected EdgeRouter X devices. Attackers who successfully exploit this vulnerability can execute arbitrary commands with the privileges of the web interface process, potentially gaining root access to the device and enabling them to modify network configurations, establish persistent backdoors, steal sensitive data, or use the compromised device as a pivot point for attacking other systems within the network. Given that these routers are commonly deployed in enterprise and residential network environments, the compromise of a single device can potentially provide attackers with access to an entire network infrastructure. The fact that this exploit has been publicly disclosed increases the risk of widespread exploitation, as malicious actors can readily develop automated tools to target vulnerable devices across different organizations.
Mitigation strategies for CVE-2023-2374 should prioritize immediate firmware updates from Ubiquiti to address the command injection vulnerability. Organizations should also implement network segmentation to limit access to the web management interface, restrict access through firewall rules, and disable the web interface when not actively needed. Additional protective measures include monitoring network traffic for suspicious requests targeting the ecn-down parameter, implementing intrusion detection systems that can identify exploitation attempts, and conducting regular vulnerability assessments of network infrastructure. Security teams should also consider disabling unnecessary services and ensuring that only authorized personnel have access to the web management interface. The vulnerability's classification as critical indicates that organizations should treat this as an immediate priority for remediation, as the public availability of exploitation tools increases the likelihood of active attacks against unpatched systems.