All the vulnerabilites related to ui - edgeswitch_firmware
cve-2019-5445
Vulnerability from cvelistv5
Published
2019-07-10 19:45
Modified
2024-08-04 19:54
Severity ?
EPSS score ?
Summary
DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:54:53.583Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "EdgeMAX",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "1.8.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Denial of Service (CWE-400)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-10T19:45:09",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"ID": "CVE-2019-5445",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "EdgeMAX",
"version": {
"version_data": [
{
"version_value": "1.8.1"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (CWE-400)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7",
"refsource": "MISC",
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2019-5445",
"datePublished": "2019-07-10T19:45:09",
"dateReserved": "2019-01-04T00:00:00",
"dateUpdated": "2024-08-04T19:54:53.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-12590
Vulnerability from cvelistv5
Published
2018-06-20 12:00
Modified
2024-09-16 22:55
Severity ?
EPSS score ?
Summary
Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code.
References
| ▼ | URL | Tags |
|---|---|---|
| https://hackerone.com/reports/311884 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T08:38:06.333Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://hackerone.com/reports/311884"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-06-20T12:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/311884"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-12590",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://hackerone.com/reports/311884",
"refsource": "MISC",
"url": "https://hackerone.com/reports/311884"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-12590",
"datePublished": "2018-06-20T12:00:00Z",
"dateReserved": "2018-06-20T00:00:00Z",
"dateUpdated": "2024-09-16T22:55:54.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-8232
Vulnerability from cvelistv5
Published
2020-08-17 15:40
Modified
2024-08-04 09:56
Severity ?
EPSS score ?
Summary
An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | n/a | EdgeSwitch firmware v1.9.0 and prior |
Version: Fixed in EdgeMax EdgeSwitch firmware v1.9.1 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:56:27.604Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.ui.com/download/edgemax"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "EdgeSwitch firmware v1.9.0 and prior",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Fixed in EdgeMax EdgeSwitch firmware v1.9.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure (CWE-200)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-17T15:40:59",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.ui.com/download/edgemax"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"ID": "CVE-2020-8232",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "EdgeSwitch firmware v1.9.0 and prior",
"version": {
"version_data": [
{
"version_value": "Fixed in EdgeMax EdgeSwitch firmware v1.9.1"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Information Disclosure (CWE-200)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821",
"refsource": "MISC",
"url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
},
{
"name": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c",
"refsource": "MISC",
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
},
{
"name": "https://www.ui.com/download/edgemax",
"refsource": "MISC",
"url": "https://www.ui.com/download/edgemax"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2020-8232",
"datePublished": "2020-08-17T15:40:59",
"dateReserved": "2020-01-28T00:00:00",
"dateUpdated": "2024-08-04T09:56:27.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-8233
Vulnerability from cvelistv5
Published
2020-08-17 15:41
Modified
2024-08-04 09:56
Severity ?
EPSS score ?
Summary
A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821 | x_refsource_MISC | |
| https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c | x_refsource_MISC | |
| https://www.ui.com/download/edgemax | x_refsource_MISC | |
| http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html | vendor-advisory, x_refsource_SUSE |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | n/a | EdgeSwitch firmware v1.9.0 and prior |
Version: Fixed version EdgeSwitch firmware v1.9.1 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:56:27.573Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.ui.com/download/edgemax"
},
{
"name": "openSUSE-SU-2020:1652",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "EdgeSwitch firmware v1.9.0 and prior",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Fixed version EdgeSwitch firmware v1.9.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A command injection vulnerability exists in EdgeSwitch firmware \u003cv1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection - Generic (CWE-77)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-10-10T23:06:22",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.ui.com/download/edgemax"
},
{
"name": "openSUSE-SU-2020:1652",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"ID": "CVE-2020-8233",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "EdgeSwitch firmware v1.9.0 and prior",
"version": {
"version_data": [
{
"version_value": "Fixed version EdgeSwitch firmware v1.9.1"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A command injection vulnerability exists in EdgeSwitch firmware \u003cv1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Command Injection - Generic (CWE-77)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821",
"refsource": "MISC",
"url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
},
{
"name": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c",
"refsource": "MISC",
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
},
{
"name": "https://www.ui.com/download/edgemax",
"refsource": "MISC",
"url": "https://www.ui.com/download/edgemax"
},
{
"name": "openSUSE-SU-2020:1652",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2020-8233",
"datePublished": "2020-08-17T15:41:19",
"dateReserved": "2020-01-28T00:00:00",
"dateUpdated": "2024-08-04T09:56:27.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-5446
Vulnerability from cvelistv5
Published
2019-07-10 19:47
Modified
2024-08-04 19:54
Severity ?
EPSS score ?
Summary
Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:54:53.484Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "EdgeMAX",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "1.8.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection - Generic (CWE-77)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-10T19:47:07",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"ID": "CVE-2019-5446",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "EdgeMAX",
"version": {
"version_data": [
{
"version_value": "1.8.1"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Command Injection - Generic (CWE-77)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7",
"refsource": "MISC",
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2019-5446",
"datePublished": "2019-07-10T19:47:07",
"dateReserved": "2019-01-04T00:00:00",
"dateUpdated": "2024-08-04T19:54:53.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2020-08-17 16:15
Modified
2024-11-21 05:38
Severity ?
Summary
A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ui | edgeswitch_firmware | * | |
| ui | ep-16-xg | - | |
| ui | ep-s16 | - | |
| ui | es-12f | - | |
| ui | es-16-150w | - | |
| ui | es-24-250w | - | |
| ui | es-24-500w | - | |
| ui | es-24-lite | - | |
| ui | es-48-500w | - | |
| ui | es-48-750w | - | |
| ui | es-48-lite | - | |
| ui | es-8-150w | - | |
| opensuse | backports_sle | 15.0 | |
| opensuse | backports_sle | 15.0 | |
| opensuse | leap | 15.1 | |
| opensuse | leap | 15.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ui:edgeswitch_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "99D34145-C467-493B-8055-6CB58FE29C37",
"versionEndExcluding": "1.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ui:ep-16-xg:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AED6B48F-78E6-4BE2-A89C-36887E3CE63B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:ep-s16:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C52B2CB9-844B-4720-BEC9-A73C9994C7AC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-12f:-:*:*:*:*:*:*:*",
"matchCriteriaId": "35E11BF8-2295-4DC3-B463-DC305B2ED456",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-16-150w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AD4B5024-6E26-4011-9392-26E304C0B00C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-24-250w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EBA2938D-8AF2-47D5-B881-AD27A999989D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-24-500w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CDFD81A-C3D6-4B54-97C6-718FEB23C57C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-24-lite:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0085DBEE-368A-400D-A2E7-AC090CCD6324",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-48-500w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D7AC5ECE-A2E4-4AD8-B65D-4B5CFFF0A044",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-48-750w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "287F2ABB-2855-4938-A5F3-857744ABC4E6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-48-lite:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0C8A7623-0F2F-49F3-81F4-515E29A907EF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-8-150w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CD0CDC1D-D5F7-437D-9544-95E8DBFBF1F7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "67E82302-4B77-44F3-97B1-24C18AC4A35D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A command injection vulnerability exists in EdgeSwitch firmware \u003cv1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges."
},
{
"lang": "es",
"value": "Se presenta una vulnerabilidad de inyecci\u00f3n de comandos en el firmware de EdgeSwitch versiones anteriores a v1.9.0, que permit\u00eda a un usuario autenticado de solo lectura ejecutar comandos de shell arbitrarios por medio de la interfaz HTTP, permiti\u00e9ndoles escalar privilegios."
}
],
"id": "CVE-2020-8233",
"lastModified": "2024-11-21T05:38:33.437",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-08-17T16:15:13.857",
"references": [
{
"source": "support@hackerone.com",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html"
},
{
"source": "support@hackerone.com",
"tags": [
"Patch",
"Release Notes",
"Vendor Advisory"
],
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
},
{
"source": "support@hackerone.com",
"tags": [
"Vendor Advisory"
],
"url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
},
{
"source": "support@hackerone.com",
"tags": [
"Product"
],
"url": "https://www.ui.com/download/edgemax"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Release Notes",
"Vendor Advisory"
],
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "https://www.ui.com/download/edgemax"
}
],
"sourceIdentifier": "support@hackerone.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "support@hackerone.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-08-17 16:15
Modified
2024-11-21 05:38
Severity ?
Summary
An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ui | edgeswitch_firmware | * | |
| ui | ep-16-xg | - | |
| ui | ep-s16 | - | |
| ui | es-12f | - | |
| ui | es-16-150w | - | |
| ui | es-24-250w | - | |
| ui | es-24-500w | - | |
| ui | es-24-lite | - | |
| ui | es-48-500w | - | |
| ui | es-48-750w | - | |
| ui | es-48-lite | - | |
| ui | es-8-150w | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ui:edgeswitch_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "99D34145-C467-493B-8055-6CB58FE29C37",
"versionEndExcluding": "1.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ui:ep-16-xg:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AED6B48F-78E6-4BE2-A89C-36887E3CE63B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:ep-s16:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C52B2CB9-844B-4720-BEC9-A73C9994C7AC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-12f:-:*:*:*:*:*:*:*",
"matchCriteriaId": "35E11BF8-2295-4DC3-B463-DC305B2ED456",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-16-150w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AD4B5024-6E26-4011-9392-26E304C0B00C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-24-250w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EBA2938D-8AF2-47D5-B881-AD27A999989D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-24-500w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CDFD81A-C3D6-4B54-97C6-718FEB23C57C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-24-lite:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0085DBEE-368A-400D-A2E7-AC090CCD6324",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-48-500w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D7AC5ECE-A2E4-4AD8-B65D-4B5CFFF0A044",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-48-750w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "287F2ABB-2855-4938-A5F3-857744ABC4E6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-48-lite:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0C8A7623-0F2F-49F3-81F4-515E29A907EF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-8-150w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CD0CDC1D-D5F7-437D-9544-95E8DBFBF1F7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages."
},
{
"lang": "es",
"value": "Se presenta una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en el firmware EdgeMax EdgeSwitch versi\u00f3n v1.9.0, que permit\u00eda a unos usuarios de solo lectura poder obtener informaci\u00f3n no autorizada por medio de las p\u00e1ginas de una comunidad SNMP."
}
],
"id": "CVE-2020-8232",
"lastModified": "2024-11-21T05:38:33.310",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-08-17T16:15:13.780",
"references": [
{
"source": "support@hackerone.com",
"tags": [
"Patch",
"Release Notes",
"Vendor Advisory"
],
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
},
{
"source": "support@hackerone.com",
"tags": [
"Vendor Advisory"
],
"url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
},
{
"source": "support@hackerone.com",
"tags": [
"Product"
],
"url": "https://www.ui.com/download/edgemax"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Release Notes",
"Vendor Advisory"
],
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "https://www.ui.com/download/edgemax"
}
],
"sourceIdentifier": "support@hackerone.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "support@hackerone.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-07-10 20:15
Modified
2024-11-21 04:44
Severity ?
Summary
DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| support@hackerone.com | https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7 | Release Notes, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ui | edgeswitch_firmware | * | |
| ui | ep-s16. | - | |
| ui | es-12f | - | |
| ui | es-16-150w | - | |
| ui | es-16-xg | - | |
| ui | es-24-250w | - | |
| ui | es-24-500w | - | |
| ui | es-24-lite | - | |
| ui | es-48-500w | - | |
| ui | es-48-750w | - | |
| ui | es-48-lite | - | |
| ui | es-8-150w | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ui:edgeswitch_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CB6F9B35-509E-4380-A473-796E32BCA88B",
"versionEndExcluding": "1.8.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ui:ep-s16.:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8E496145-AC02-4EF5-8FE2-BF5593F89ABA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-12f:-:*:*:*:*:*:*:*",
"matchCriteriaId": "35E11BF8-2295-4DC3-B463-DC305B2ED456",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-16-150w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AD4B5024-6E26-4011-9392-26E304C0B00C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-16-xg:-:*:*:*:*:*:*:*",
"matchCriteriaId": "82590A80-2DA6-4BA3-BAF9-DA6B9118C7E2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-24-250w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EBA2938D-8AF2-47D5-B881-AD27A999989D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-24-500w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CDFD81A-C3D6-4B54-97C6-718FEB23C57C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-24-lite:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0085DBEE-368A-400D-A2E7-AC090CCD6324",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-48-500w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D7AC5ECE-A2E4-4AD8-B65D-4B5CFFF0A044",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-48-750w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "287F2ABB-2855-4938-A5F3-857744ABC4E6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-48-lite:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0C8A7623-0F2F-49F3-81F4-515E29A907EF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-8-150w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CD0CDC1D-D5F7-437D-9544-95E8DBFBF1F7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands."
},
{
"lang": "es",
"value": "Una DoS en EdgeMAX EdgeSwitch versiones anteriores a 1.8.2, permite que un usuario administrador Bloquee la interfaz de la CLI de SSH mediante el uso de comandos especialmente dise\u00f1ados."
}
],
"id": "CVE-2019-5445",
"lastModified": "2024-11-21T04:44:56.923",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-10T20:15:12.687",
"references": [
{
"source": "support@hackerone.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
}
],
"sourceIdentifier": "support@hackerone.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-400"
}
],
"source": "support@hackerone.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-400"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-06-20 12:29
Modified
2024-11-21 03:45
Severity ?
Summary
Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://hackerone.com/reports/311884 | Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://hackerone.com/reports/311884 | Issue Tracking, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ui | edgeswitch_firmware | * | |
| ui | edgeswitch | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ui:edgeswitch_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "127D25C4-F0BC-48B7-89CE-079B87292A89",
"versionEndIncluding": "1.7.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ui:edgeswitch:-:*:*:*:*:*:*:*",
"matchCriteriaId": "ABB00A65-136C-4CF7-AF64-28AD6AB03883",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code."
},
{
"lang": "es",
"value": "EdgeSwitch, de Ubiquiti Networks, en versiones 1.7.3 y anteriores sufre de una vulnerabilidad de cadena de formato controlada externamente debido a la falta de protecci\u00f3n de la interfaz de l\u00ednea de comandos admin. Esto conduce a la ejecuci\u00f3n de c\u00f3digo y a un escalado de privilegios mayor del que les est\u00e1 permitido a los propios administradores. Un atacante que cuente con acceso a una cuenta de administrador podr\u00eda escapar de la interfaz de l\u00ednea de comandos restringida y ejecutar c\u00f3digo arbitrario."
}
],
"id": "CVE-2018-12590",
"lastModified": "2024-11-21T03:45:29.880",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-06-20T12:29:00.320",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://hackerone.com/reports/311884"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://hackerone.com/reports/311884"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-134"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-07-10 20:15
Modified
2024-11-21 04:44
Severity ?
Summary
Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| support@hackerone.com | https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7 | Release Notes, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ui | edgeswitch_firmware | * | |
| ui | ep-s16. | - | |
| ui | es-12f | - | |
| ui | es-16-150w | - | |
| ui | es-16-xg | - | |
| ui | es-24-250w | - | |
| ui | es-24-500w | - | |
| ui | es-24-lite | - | |
| ui | es-48-500w | - | |
| ui | es-48-750w | - | |
| ui | es-48-lite | - | |
| ui | es-8-150w | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ui:edgeswitch_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CB6F9B35-509E-4380-A473-796E32BCA88B",
"versionEndExcluding": "1.8.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ui:ep-s16.:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8E496145-AC02-4EF5-8FE2-BF5593F89ABA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-12f:-:*:*:*:*:*:*:*",
"matchCriteriaId": "35E11BF8-2295-4DC3-B463-DC305B2ED456",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-16-150w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AD4B5024-6E26-4011-9392-26E304C0B00C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-16-xg:-:*:*:*:*:*:*:*",
"matchCriteriaId": "82590A80-2DA6-4BA3-BAF9-DA6B9118C7E2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-24-250w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EBA2938D-8AF2-47D5-B881-AD27A999989D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-24-500w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CDFD81A-C3D6-4B54-97C6-718FEB23C57C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-24-lite:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0085DBEE-368A-400D-A2E7-AC090CCD6324",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-48-500w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D7AC5ECE-A2E4-4AD8-B65D-4B5CFFF0A044",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-48-750w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "287F2ABB-2855-4938-A5F3-857744ABC4E6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-48-lite:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0C8A7623-0F2F-49F3-81F4-515E29A907EF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:ui:es-8-150w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CD0CDC1D-D5F7-437D-9544-95E8DBFBF1F7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root."
},
{
"lang": "es",
"value": "Una Inyecci\u00f3n de Comandos en EdgeMAX EdgeSwitch versiones anteriores a 1.8.2, permite a un usuario administrador ejecutar comandos como root."
}
],
"id": "CVE-2019-5446",
"lastModified": "2024-11-21T04:44:57.033",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-10T20:15:12.763",
"references": [
{
"source": "support@hackerone.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
}
],
"sourceIdentifier": "support@hackerone.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "support@hackerone.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}