CVE-2023-2376 in EdgeRouter X
Summary
by MITRE • 04/28/2023
A security vulnerability has been detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The affected element is an unknown function of the component Web Management Interface. The manipulation of the argument dpi leads to command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. There are still doubts about whether this vulnerability truly exists. The vendor position is that post-authentication issues are not accepted as vulnerabilities.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/09/2026
The vulnerability identified as CVE-2023-2376 represents a critical command injection flaw within the web management interface of Ubiquiti EdgeRouter X devices running firmware versions up to 2.0.9-hotfix.6. This vulnerability specifically affects the dpi argument handling within an unknown function of the web interface component, creating a significant security risk for network infrastructure deployments. The flaw enables remote exploitation through the web management interface, making it particularly dangerous as it can be leveraged by attackers without requiring physical access to the device or local network presence. The vulnerability has been publicly disclosed with the identifier VDB-227652, indicating that malicious actors may already be utilizing this weakness in active attacks against affected systems.
The technical nature of this vulnerability aligns with CWE-77 and CWE-94 categories, representing command injection and code injection flaws respectively. The dpi argument manipulation allows attackers to inject arbitrary commands that execute within the context of the web server process, potentially enabling full system compromise. This type of vulnerability typically arises from insufficient input validation and sanitization within web applications, where user-supplied parameters are directly incorporated into system commands without proper escaping or filtering mechanisms. The web management interface serves as the primary attack surface, making it a critical component for network administrators to secure.
The operational impact of this vulnerability extends beyond simple unauthorized access, as command injection flaws can enable attackers to execute arbitrary code with the privileges of the web server process. This could result in complete system compromise, data exfiltration, network reconnaissance, and potential lateral movement within the network infrastructure. Network administrators managing EdgeRouter X devices are particularly vulnerable since these devices often serve as core network components with critical routing and security functions. The remote exploit capability means that attackers can target these devices from outside the network perimeter, potentially compromising entire network infrastructures without requiring additional attack vectors.
Mitigation strategies should prioritize immediate firmware updates to versions that address this vulnerability, as provided by Ubiquiti. Network segmentation and firewall rules should be implemented to restrict access to the web management interface to trusted IP addresses only, while disabling unnecessary services and ports. The principle of least privilege should be enforced by limiting web interface access to only authorized personnel and implementing multi-factor authentication where possible. Network monitoring should be enhanced to detect unusual command execution patterns or suspicious network traffic originating from affected devices. Additionally, organizations should conduct comprehensive vulnerability assessments of their network infrastructure to identify any other Ubiquiti devices that may be running vulnerable firmware versions, as similar vulnerabilities may exist in other components of the Ubiquiti product line. The ATT&CK framework categorizes this vulnerability under T1059.001 (Command and Scripting Interpreter: PowerShell) and T1068 (Exploitation for Privilege Escalation) techniques, emphasizing the need for both network-level defenses and endpoint monitoring solutions to detect and prevent exploitation attempts.