Ubiquiti EdgeRouter/UniFi Security Gateway up to 2.0.9-hotf/4.4.56 DHCPv6 Prefix Delegation special elements into a different plane (special element injection)

Summaryinfo

A vulnerability classified as critical has been found in Ubiquiti EdgeRouter and UniFi Security Gateway up to 2.0.9-hotf/4.4.56. This issue affects some unknown processing of the component DHCPv6 Prefix Delegation Handler. The manipulation leads to failure to sanitize special elements into a different plane (special element injection). This vulnerability is traded as CVE-2023-23912. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Ubiquiti EdgeRouter and UniFi Security Gateway up to 2.0.9-hotf/4.4.56 (Router Operating System). It has been rated as critical. This issue affects some unknown processing of the component DHCPv6 Prefix Delegation Handler. The manipulation with an unknown input leads to a failure to sanitize special elements into a different plane (special element injection) vulnerability. Using CWE to declare the problem leads to CWE-75. The product does not adequately filter user-controlled input for special elements with control implications. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix delegation set to dhcpv6-stateless or dhcpv6-stateful, allows a malicious actor directly connected to the WAN interface of an affected device to create a remote code execution vulnerability.

The weakness was shared 02/09/2023. It is possible to read the advisory at community.ui.com. The identification of this vulnerability is CVE-2023-23912 since 01/19/2023. The technical details are unknown and an exploit is not publicly available.

Upgrading eliminates this vulnerability. The upgrade is hosted for download at community.ui.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-27995). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Ubiquiti

Name

• EdgeRouter
• UniFi Security Gateway

Version

• 2.0.9-hotf
• 4.4.0
• 4.4.1
• 4.4.2
• 4.4.3
• 4.4.4
• 4.4.5
• 4.4.6
• 4.4.7
• 4.4.8
• 4.4.9
• 4.4.10
• 4.4.11
• 4.4.12
• 4.4.13
• 4.4.14
• 4.4.15
• 4.4.16
• 4.4.17
• 4.4.18
• 4.4.19
• 4.4.20
• 4.4.21
• 4.4.22
• 4.4.23
• 4.4.24
• 4.4.25
• 4.4.26
• 4.4.27
• 4.4.28
• 4.4.29
• 4.4.30
• 4.4.31
• 4.4.32
• 4.4.33
• 4.4.34
• 4.4.35
• 4.4.36
• 4.4.37
• 4.4.38
• 4.4.39
• 4.4.40
• 4.4.41
• 4.4.42
• 4.4.43
• 4.4.44
• 4.4.45
• 4.4.46
• 4.4.47
• 4.4.48
• 4.4.49
• 4.4.50
• 4.4.51
• 4.4.52
• 4.4.53
• 4.4.54
• 4.4.55
• 4.4.56

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion