CVE-2023-2374

A security flaw has been discovered in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This issue affects some unknown processing of the component Web Management Interface. Performing a manipulation of the argument ecn-down results in command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The existence of this vulnerability is still disputed at present. The vendor position is that post-authentication issues are not accepted as vulnerabilities.

• CWE-74
• CWE-77

• https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/6Exploit, Third Party Advisory
• https://vuldb.com/cve/CVE-2023-2374
• https://vuldb.com/submit/114075
• https://vuldb.com/vuln/227650
• https://vuldb.com/vuln/227650/cti
• https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/6Exploit, Third Party Advisory
• https://vuldb.com/?ctiid.227650Permissions Required, Third Party Advisory
• https://vuldb.com/?id.227650Third Party Advisory

Published

Apr 28, 2023

Last Modified

Jul 9, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-23732Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-23733Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-23734Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-23735Improper Neutralization of Script-Related HTML Tags in a Web…6.1
• CVE-2023-23737Unauth. SQL Injection (SQLi) vulnerability in MainWP MainWP …9.8
• CVE-2023-23738Improper Neutralization of Special Elements in Output Used b…5.3
• CVE-2023-23749The 'LDAP Integration with Active Directory and OpenLDAP - N…7.5
• CVE-2023-2375A weakness has been identified in Ubiquiti EdgeRouter X up t…7.2
• CVE-2023-23750An issue was discovered in Joomla! 4.0.0 through 4.2.6. A mi…6.3
• CVE-2023-23751An issue was discovered in Joomla! 4.0.0 through 4.2.4. A mi…4.3
• CVE-2023-23752An issue was discovered in Joomla! 4.0.0 through 4.2.7. An i…5.3
• CVE-2023-23753The 'Visforms Base Package for Joomla 3' extension is vulner…9.8