Vulnerability · Published Aug 17, 2020 · Assigned by hackerone
CVE-2020-8233
High 8.8
In plain English
A high-severity command injection in EdgeSwitch firmware v1.9.0 and prior. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.4% (higher than 91% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)4.4%top 8.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | EdgeSwitch firmware v1.9.0 and prior | Fixed version EdgeSwitch firmware v1.9.1 |
Weakness: CWE-77
References
- https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821 x_refsource_MISC
- https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c x_refsource_MISC
- https://www.ui.com/download/edgemax x_refsource_MISC
- openSUSE-SU-2020:1652 vendor-advisory, x_refsource_SUSE