Ubiquiti Networks EdgeSwitch up to 1.7.3 CLI format string

Summaryinfo

A vulnerability has been found in Ubiquiti Networks EdgeSwitch up to 1.7.3 and classified as critical. The impacted element is an unknown function of the component CLI. This manipulation causes format string. This vulnerability is handled as CVE-2018-12590. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in Ubiquiti Networks EdgeSwitch up to 1.7.3 and classified as critical. Affected by this vulnerability is an unknown part of the component CLI. The manipulation with an unknown input leads to a format string vulnerability. The CWE definition for the vulnerability is CWE-134. The product uses a function that accepts a format string as an argument, but the format string originates from an external source. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code.

The bug was discovered 06/19/2018. The weakness was released 06/20/2018 (Website). It is possible to read the advisory at hackerone.com. This vulnerability is known as CVE-2018-12590 since 06/20/2018. The exploitation appears to be easy. The attack can be launched remotely. A single authentication is necessary for exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entry connected to this vulnerability is available at VDB-119732. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Ubiquiti

Name

• Networks EdgeSwitch

Version

• 1.7.0
• 1.7.1
• 1.7.2
• 1.7.3

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion