CVE-2023-2375 in EdgeRouter X
Summary
by MITRE • 04/28/2023
A weakness has been identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. Impacted is an unknown function of the component Web Management Interface. Executing a manipulation of the argument src can lead to command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The presence of this vulnerability remains uncertain at this time. The vendor position is that post-authentication issues are not accepted as vulnerabilities.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/09/2026
The vulnerability identified as CVE-2023-2375 represents a critical command injection flaw within Ubiquiti EdgeRouter X devices running firmware versions up to 2.0.9-hotfix.6. This security weakness resides in the Web Management Interface component, which serves as the primary administrative portal for configuring and managing these network devices. The vulnerability stems from inadequate input validation within the web interface's processing logic, specifically when handling the src argument parameter. Attackers can exploit this flaw by manipulating the src argument to inject malicious commands that execute with the privileges of the web server process, potentially compromising the entire network infrastructure.
The technical implementation of this vulnerability follows the common command injection pattern where user-supplied input is directly incorporated into system commands without proper sanitization or escaping mechanisms. When a remote attacker sends a crafted request containing malicious payload within the src parameter, the web interface processes this input without adequate validation, allowing arbitrary command execution. This type of vulnerability is classified under CWE-77 as "Improper Neutralization of Special Elements used in a Command ('Command Injection')", which is a well-documented weakness in web application security. The attack vector is particularly concerning as it requires no local access or authentication, making it exploitable over the network from any remote location with access to the web management interface.
The operational impact of this vulnerability extends far beyond simple unauthorized access, as it provides attackers with complete control over the affected EdgeRouter X device. Once exploited, malicious actors can execute arbitrary commands on the underlying operating system, potentially leading to complete network compromise, data exfiltration, or the establishment of persistent backdoors. The vulnerability's critical classification indicates that it can be easily exploited by automated tools, as evidenced by the public disclosure of the exploit code. Network administrators face significant risk as these devices are commonly deployed in enterprise and residential networks where they serve as critical routing and security infrastructure components. The exposure of the VDB-227651 identifier confirms that this vulnerability has been actively weaponized in the wild, increasing the urgency for immediate remediation.
Mitigation strategies for CVE-2023-2375 should prioritize immediate firmware updates from Ubiquiti to the latest available versions that address this command injection vulnerability. Organizations should implement network segmentation to limit access to the web management interface, restricting access to trusted IP addresses and employing network access control lists to prevent unauthorized remote connections. The principle of least privilege should be applied by disabling unnecessary web management services when not required for administration. Additionally, network monitoring should be enhanced to detect anomalous command execution patterns and unusual traffic to the web interface ports. Security teams should consider implementing web application firewalls to filter malicious requests targeting the src parameter and establish regular vulnerability scanning procedures to identify similar weaknesses in network infrastructure components. This vulnerability demonstrates the importance of maintaining current firmware versions and following security best practices for network device management, as outlined in the mitre ATT&CK framework's network infrastructure tactics and techniques.