Search criteria

15 vulnerabilities found for edgeswitch_firmware by ui

FKIE_CVE-2020-8232

Vulnerability from fkie_nvd - Published: 2020-08-17 16:15 - Updated: 2024-11-21 05:38
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages.
References
support@hackerone.comhttps://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695cPatch, Release Notes, Vendor Advisory
support@hackerone.comhttps://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821Vendor Advisory
support@hackerone.comhttps://www.ui.com/download/edgemaxProduct
af854a3a-2127-422b-91ae-364da2661108https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695cPatch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.ui.com/download/edgemaxProduct
Impacted products
Vendor Product Version
ui edgeswitch_firmware *
ui ep-16-xg -
ui ep-s16 -
ui es-12f -
ui es-16-150w -
ui es-24-250w -
ui es-24-500w -
ui es-24-lite -
ui es-48-500w -
ui es-48-750w -
ui es-48-lite -
ui es-8-150w -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ui:edgeswitch_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "99D34145-C467-493B-8055-6CB58FE29C37",
              "versionEndExcluding": "1.9.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ui:ep-16-xg:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AED6B48F-78E6-4BE2-A89C-36887E3CE63B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:ep-s16:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C52B2CB9-844B-4720-BEC9-A73C9994C7AC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-12f:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "35E11BF8-2295-4DC3-B463-DC305B2ED456",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-16-150w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD4B5024-6E26-4011-9392-26E304C0B00C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-24-250w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EBA2938D-8AF2-47D5-B881-AD27A999989D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-24-500w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2CDFD81A-C3D6-4B54-97C6-718FEB23C57C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-24-lite:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0085DBEE-368A-400D-A2E7-AC090CCD6324",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-48-500w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7AC5ECE-A2E4-4AD8-B65D-4B5CFFF0A044",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-48-750w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "287F2ABB-2855-4938-A5F3-857744ABC4E6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-48-lite:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C8A7623-0F2F-49F3-81F4-515E29A907EF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-8-150w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD0CDC1D-D5F7-437D-9544-95E8DBFBF1F7",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en el firmware EdgeMax EdgeSwitch versi\u00f3n v1.9.0,  que permit\u00eda a unos usuarios de solo lectura poder obtener informaci\u00f3n no autorizada por medio de las p\u00e1ginas de una comunidad SNMP."
    }
  ],
  "id": "CVE-2020-8232",
  "lastModified": "2024-11-21T05:38:33.310",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-08-17T16:15:13.780",
  "references": [
    {
      "source": "support@hackerone.com",
      "tags": [
        "Patch",
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
    },
    {
      "source": "support@hackerone.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
    },
    {
      "source": "support@hackerone.com",
      "tags": [
        "Product"
      ],
      "url": "https://www.ui.com/download/edgemax"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://www.ui.com/download/edgemax"
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "support@hackerone.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2020-8233

Vulnerability from fkie_nvd - Published: 2020-08-17 16:15 - Updated: 2024-11-21 05:38
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges.
References
support@hackerone.comhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.htmlMailing List, Third Party Advisory
support@hackerone.comhttps://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695cPatch, Release Notes, Vendor Advisory
support@hackerone.comhttps://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821Vendor Advisory
support@hackerone.comhttps://www.ui.com/download/edgemaxProduct
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695cPatch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.ui.com/download/edgemaxProduct
Impacted products
Vendor Product Version
ui edgeswitch_firmware *
ui ep-16-xg -
ui ep-s16 -
ui es-12f -
ui es-16-150w -
ui es-24-250w -
ui es-24-500w -
ui es-24-lite -
ui es-48-500w -
ui es-48-750w -
ui es-48-lite -
ui es-8-150w -
opensuse backports_sle 15.0
opensuse backports_sle 15.0
opensuse leap 15.1
opensuse leap 15.2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ui:edgeswitch_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "99D34145-C467-493B-8055-6CB58FE29C37",
              "versionEndExcluding": "1.9.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ui:ep-16-xg:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AED6B48F-78E6-4BE2-A89C-36887E3CE63B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:ep-s16:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C52B2CB9-844B-4720-BEC9-A73C9994C7AC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-12f:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "35E11BF8-2295-4DC3-B463-DC305B2ED456",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-16-150w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD4B5024-6E26-4011-9392-26E304C0B00C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-24-250w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EBA2938D-8AF2-47D5-B881-AD27A999989D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-24-500w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2CDFD81A-C3D6-4B54-97C6-718FEB23C57C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-24-lite:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0085DBEE-368A-400D-A2E7-AC090CCD6324",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-48-500w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7AC5ECE-A2E4-4AD8-B65D-4B5CFFF0A044",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-48-750w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "287F2ABB-2855-4938-A5F3-857744ABC4E6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-48-lite:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C8A7623-0F2F-49F3-81F4-515E29A907EF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-8-150w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD0CDC1D-D5F7-437D-9544-95E8DBFBF1F7",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "67E82302-4B77-44F3-97B1-24C18AC4A35D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A command injection vulnerability exists in EdgeSwitch firmware \u003cv1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de inyecci\u00f3n de comandos en el firmware de EdgeSwitch versiones anteriores a v1.9.0, que permit\u00eda a un usuario autenticado de solo lectura ejecutar comandos de shell arbitrarios por medio de la interfaz HTTP, permiti\u00e9ndoles escalar privilegios."
    }
  ],
  "id": "CVE-2020-8233",
  "lastModified": "2024-11-21T05:38:33.437",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-08-17T16:15:13.857",
  "references": [
    {
      "source": "support@hackerone.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html"
    },
    {
      "source": "support@hackerone.com",
      "tags": [
        "Patch",
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
    },
    {
      "source": "support@hackerone.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
    },
    {
      "source": "support@hackerone.com",
      "tags": [
        "Product"
      ],
      "url": "https://www.ui.com/download/edgemax"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://www.ui.com/download/edgemax"
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ],
      "source": "support@hackerone.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2019-5445

Vulnerability from fkie_nvd - Published: 2019-07-10 20:15 - Updated: 2024-11-21 04:44
Severity ?
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Summary
DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands.
References
support@hackerone.comhttps://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
ui edgeswitch_firmware *
ui ep-s16. -
ui es-12f -
ui es-16-150w -
ui es-16-xg -
ui es-24-250w -
ui es-24-500w -
ui es-24-lite -
ui es-48-500w -
ui es-48-750w -
ui es-48-lite -
ui es-8-150w -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ui:edgeswitch_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CB6F9B35-509E-4380-A473-796E32BCA88B",
              "versionEndExcluding": "1.8.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ui:ep-s16.:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E496145-AC02-4EF5-8FE2-BF5593F89ABA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-12f:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "35E11BF8-2295-4DC3-B463-DC305B2ED456",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-16-150w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD4B5024-6E26-4011-9392-26E304C0B00C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-16-xg:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "82590A80-2DA6-4BA3-BAF9-DA6B9118C7E2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-24-250w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EBA2938D-8AF2-47D5-B881-AD27A999989D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-24-500w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2CDFD81A-C3D6-4B54-97C6-718FEB23C57C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-24-lite:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0085DBEE-368A-400D-A2E7-AC090CCD6324",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-48-500w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7AC5ECE-A2E4-4AD8-B65D-4B5CFFF0A044",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-48-750w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "287F2ABB-2855-4938-A5F3-857744ABC4E6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-48-lite:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C8A7623-0F2F-49F3-81F4-515E29A907EF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-8-150w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD0CDC1D-D5F7-437D-9544-95E8DBFBF1F7",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands."
    },
    {
      "lang": "es",
      "value": "Una DoS en EdgeMAX EdgeSwitch versiones anteriores a 1.8.2, permite que un usuario administrador Bloquee la interfaz de la CLI de SSH mediante el uso de comandos especialmente dise\u00f1ados."
    }
  ],
  "id": "CVE-2019-5445",
  "lastModified": "2024-11-21T04:44:56.923",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 4.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-07-10T20:15:12.687",
  "references": [
    {
      "source": "support@hackerone.com",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "support@hackerone.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2019-5446

Vulnerability from fkie_nvd - Published: 2019-07-10 20:15 - Updated: 2024-11-21 04:44
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root.
References
support@hackerone.comhttps://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
ui edgeswitch_firmware *
ui ep-s16. -
ui es-12f -
ui es-16-150w -
ui es-16-xg -
ui es-24-250w -
ui es-24-500w -
ui es-24-lite -
ui es-48-500w -
ui es-48-750w -
ui es-48-lite -
ui es-8-150w -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ui:edgeswitch_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CB6F9B35-509E-4380-A473-796E32BCA88B",
              "versionEndExcluding": "1.8.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ui:ep-s16.:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E496145-AC02-4EF5-8FE2-BF5593F89ABA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-12f:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "35E11BF8-2295-4DC3-B463-DC305B2ED456",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-16-150w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD4B5024-6E26-4011-9392-26E304C0B00C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-16-xg:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "82590A80-2DA6-4BA3-BAF9-DA6B9118C7E2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-24-250w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EBA2938D-8AF2-47D5-B881-AD27A999989D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-24-500w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2CDFD81A-C3D6-4B54-97C6-718FEB23C57C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-24-lite:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0085DBEE-368A-400D-A2E7-AC090CCD6324",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-48-500w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7AC5ECE-A2E4-4AD8-B65D-4B5CFFF0A044",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-48-750w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "287F2ABB-2855-4938-A5F3-857744ABC4E6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-48-lite:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C8A7623-0F2F-49F3-81F4-515E29A907EF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:ui:es-8-150w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD0CDC1D-D5F7-437D-9544-95E8DBFBF1F7",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root."
    },
    {
      "lang": "es",
      "value": "Una Inyecci\u00f3n de Comandos en EdgeMAX EdgeSwitch versiones anteriores a 1.8.2, permite a un usuario administrador ejecutar comandos como root."
    }
  ],
  "id": "CVE-2019-5446",
  "lastModified": "2024-11-21T04:44:57.033",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-07-10T20:15:12.763",
  "references": [
    {
      "source": "support@hackerone.com",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ],
      "source": "support@hackerone.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2018-12590

Vulnerability from fkie_nvd - Published: 2018-06-20 12:29 - Updated: 2024-11-21 03:45
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code.
References
cve@mitre.orghttps://hackerone.com/reports/311884Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://hackerone.com/reports/311884Issue Tracking, Third Party Advisory
Impacted products
Vendor Product Version
ui edgeswitch_firmware *
ui edgeswitch -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ui:edgeswitch_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "127D25C4-F0BC-48B7-89CE-079B87292A89",
              "versionEndIncluding": "1.7.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ui:edgeswitch:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ABB00A65-136C-4CF7-AF64-28AD6AB03883",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code."
    },
    {
      "lang": "es",
      "value": "EdgeSwitch, de Ubiquiti Networks, en versiones 1.7.3 y anteriores sufre de una vulnerabilidad de cadena de formato controlada externamente debido a la falta de protecci\u00f3n de la interfaz de l\u00ednea de comandos admin. Esto conduce a la ejecuci\u00f3n de c\u00f3digo y a un escalado de privilegios mayor del que les est\u00e1 permitido a los propios administradores. Un atacante que cuente con acceso a una cuenta de administrador podr\u00eda escapar de la interfaz de l\u00ednea de comandos restringida y ejecutar c\u00f3digo arbitrario."
    }
  ],
  "id": "CVE-2018-12590",
  "lastModified": "2024-11-21T03:45:29.880",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-06-20T12:29:00.320",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://hackerone.com/reports/311884"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://hackerone.com/reports/311884"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-134"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2020-8233 (GCVE-0-2020-8233)

Vulnerability from cvelistv5 – Published: 2020-08-17 15:41 – Updated: 2024-08-04 09:56
VLAI?
Summary
A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges.
Severity ?
No CVSS data available.
CWE
  • CWE-77 - Command Injection - Generic (CWE-77)
Assigner
References
Impacted products
Vendor Product Version
n/a EdgeSwitch firmware v1.9.0 and prior Affected: Fixed version EdgeSwitch firmware v1.9.1
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:56:27.573Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ui.com/download/edgemax"
          },
          {
            "name": "openSUSE-SU-2020:1652",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EdgeSwitch firmware v1.9.0 and prior",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed version EdgeSwitch firmware v1.9.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A command injection vulnerability exists in EdgeSwitch firmware \u003cv1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Command Injection - Generic (CWE-77)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-10T23:06:22",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ui.com/download/edgemax"
        },
        {
          "name": "openSUSE-SU-2020:1652",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2020-8233",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EdgeSwitch firmware v1.9.0 and prior",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Fixed version EdgeSwitch firmware v1.9.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A command injection vulnerability exists in EdgeSwitch firmware \u003cv1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Command Injection - Generic (CWE-77)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821",
              "refsource": "MISC",
              "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
            },
            {
              "name": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c",
              "refsource": "MISC",
              "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
            },
            {
              "name": "https://www.ui.com/download/edgemax",
              "refsource": "MISC",
              "url": "https://www.ui.com/download/edgemax"
            },
            {
              "name": "openSUSE-SU-2020:1652",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2020-8233",
    "datePublished": "2020-08-17T15:41:19",
    "dateReserved": "2020-01-28T00:00:00",
    "dateUpdated": "2024-08-04T09:56:27.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-8232 (GCVE-0-2020-8232)

Vulnerability from cvelistv5 – Published: 2020-08-17 15:40 – Updated: 2024-08-04 09:56
VLAI?
Summary
An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages.
Severity ?
No CVSS data available.
CWE
  • CWE-200 - Information Disclosure (CWE-200)
Assigner
References
Impacted products
Vendor Product Version
n/a EdgeSwitch firmware v1.9.0 and prior Affected: Fixed in EdgeMax EdgeSwitch firmware v1.9.1
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:56:27.604Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ui.com/download/edgemax"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EdgeSwitch firmware v1.9.0 and prior",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in EdgeMax EdgeSwitch firmware v1.9.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Information Disclosure (CWE-200)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-08-17T15:40:59",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ui.com/download/edgemax"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2020-8232",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EdgeSwitch firmware v1.9.0 and prior",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Fixed in EdgeMax EdgeSwitch firmware v1.9.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure (CWE-200)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821",
              "refsource": "MISC",
              "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
            },
            {
              "name": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c",
              "refsource": "MISC",
              "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
            },
            {
              "name": "https://www.ui.com/download/edgemax",
              "refsource": "MISC",
              "url": "https://www.ui.com/download/edgemax"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2020-8232",
    "datePublished": "2020-08-17T15:40:59",
    "dateReserved": "2020-01-28T00:00:00",
    "dateUpdated": "2024-08-04T09:56:27.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-5446 (GCVE-0-2019-5446)

Vulnerability from cvelistv5 – Published: 2019-07-10 19:47 – Updated: 2024-08-04 19:54
VLAI?
Summary
Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root.
Severity ?
No CVSS data available.
CWE
  • CWE-77 - Command Injection - Generic (CWE-77)
Assigner
References
Impacted products
Vendor Product Version
n/a EdgeMAX Affected: 1.8.1
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:54:53.484Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EdgeMAX",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "1.8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Command Injection - Generic (CWE-77)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-07-10T19:47:07",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2019-5446",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EdgeMAX",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.8.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Command Injection - Generic (CWE-77)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7",
              "refsource": "MISC",
              "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2019-5446",
    "datePublished": "2019-07-10T19:47:07",
    "dateReserved": "2019-01-04T00:00:00",
    "dateUpdated": "2024-08-04T19:54:53.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-5445 (GCVE-0-2019-5445)

Vulnerability from cvelistv5 – Published: 2019-07-10 19:45 – Updated: 2024-08-04 19:54
VLAI?
Summary
DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands.
Severity ?
No CVSS data available.
CWE
  • CWE-400 - Denial of Service (CWE-400)
Assigner
References
Impacted products
Vendor Product Version
n/a EdgeMAX Affected: 1.8.1
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:54:53.583Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EdgeMAX",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "1.8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Denial of Service (CWE-400)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-07-10T19:45:09",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2019-5445",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EdgeMAX",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.8.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service (CWE-400)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7",
              "refsource": "MISC",
              "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2019-5445",
    "datePublished": "2019-07-10T19:45:09",
    "dateReserved": "2019-01-04T00:00:00",
    "dateUpdated": "2024-08-04T19:54:53.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-12590 (GCVE-0-2018-12590)

Vulnerability from cvelistv5 – Published: 2018-06-20 12:00 – Updated: 2024-09-16 22:55
VLAI?
Summary
Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:38:06.333Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/311884"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-20T12:00:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/311884"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-12590",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/311884",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/311884"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-12590",
    "datePublished": "2018-06-20T12:00:00Z",
    "dateReserved": "2018-06-20T00:00:00Z",
    "dateUpdated": "2024-09-16T22:55:54.622Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-8233 (GCVE-0-2020-8233)

Vulnerability from nvd – Published: 2020-08-17 15:41 – Updated: 2024-08-04 09:56
VLAI?
Summary
A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges.
Severity ?
No CVSS data available.
CWE
  • CWE-77 - Command Injection - Generic (CWE-77)
Assigner
References
Impacted products
Vendor Product Version
n/a EdgeSwitch firmware v1.9.0 and prior Affected: Fixed version EdgeSwitch firmware v1.9.1
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:56:27.573Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ui.com/download/edgemax"
          },
          {
            "name": "openSUSE-SU-2020:1652",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EdgeSwitch firmware v1.9.0 and prior",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed version EdgeSwitch firmware v1.9.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A command injection vulnerability exists in EdgeSwitch firmware \u003cv1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Command Injection - Generic (CWE-77)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-10T23:06:22",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ui.com/download/edgemax"
        },
        {
          "name": "openSUSE-SU-2020:1652",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2020-8233",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EdgeSwitch firmware v1.9.0 and prior",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Fixed version EdgeSwitch firmware v1.9.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A command injection vulnerability exists in EdgeSwitch firmware \u003cv1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Command Injection - Generic (CWE-77)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821",
              "refsource": "MISC",
              "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
            },
            {
              "name": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c",
              "refsource": "MISC",
              "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
            },
            {
              "name": "https://www.ui.com/download/edgemax",
              "refsource": "MISC",
              "url": "https://www.ui.com/download/edgemax"
            },
            {
              "name": "openSUSE-SU-2020:1652",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2020-8233",
    "datePublished": "2020-08-17T15:41:19",
    "dateReserved": "2020-01-28T00:00:00",
    "dateUpdated": "2024-08-04T09:56:27.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-8232 (GCVE-0-2020-8232)

Vulnerability from nvd – Published: 2020-08-17 15:40 – Updated: 2024-08-04 09:56
VLAI?
Summary
An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages.
Severity ?
No CVSS data available.
CWE
  • CWE-200 - Information Disclosure (CWE-200)
Assigner
References
Impacted products
Vendor Product Version
n/a EdgeSwitch firmware v1.9.0 and prior Affected: Fixed in EdgeMax EdgeSwitch firmware v1.9.1
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:56:27.604Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ui.com/download/edgemax"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EdgeSwitch firmware v1.9.0 and prior",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in EdgeMax EdgeSwitch firmware v1.9.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Information Disclosure (CWE-200)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-08-17T15:40:59",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ui.com/download/edgemax"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2020-8232",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EdgeSwitch firmware v1.9.0 and prior",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Fixed in EdgeMax EdgeSwitch firmware v1.9.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure (CWE-200)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821",
              "refsource": "MISC",
              "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"
            },
            {
              "name": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c",
              "refsource": "MISC",
              "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"
            },
            {
              "name": "https://www.ui.com/download/edgemax",
              "refsource": "MISC",
              "url": "https://www.ui.com/download/edgemax"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2020-8232",
    "datePublished": "2020-08-17T15:40:59",
    "dateReserved": "2020-01-28T00:00:00",
    "dateUpdated": "2024-08-04T09:56:27.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-5446 (GCVE-0-2019-5446)

Vulnerability from nvd – Published: 2019-07-10 19:47 – Updated: 2024-08-04 19:54
VLAI?
Summary
Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root.
Severity ?
No CVSS data available.
CWE
  • CWE-77 - Command Injection - Generic (CWE-77)
Assigner
References
Impacted products
Vendor Product Version
n/a EdgeMAX Affected: 1.8.1
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:54:53.484Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EdgeMAX",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "1.8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Command Injection - Generic (CWE-77)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-07-10T19:47:07",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2019-5446",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EdgeMAX",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.8.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Command Injection - Generic (CWE-77)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7",
              "refsource": "MISC",
              "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2019-5446",
    "datePublished": "2019-07-10T19:47:07",
    "dateReserved": "2019-01-04T00:00:00",
    "dateUpdated": "2024-08-04T19:54:53.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-5445 (GCVE-0-2019-5445)

Vulnerability from nvd – Published: 2019-07-10 19:45 – Updated: 2024-08-04 19:54
VLAI?
Summary
DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands.
Severity ?
No CVSS data available.
CWE
  • CWE-400 - Denial of Service (CWE-400)
Assigner
References
Impacted products
Vendor Product Version
n/a EdgeMAX Affected: 1.8.1
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:54:53.583Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EdgeMAX",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "1.8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Denial of Service (CWE-400)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-07-10T19:45:09",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2019-5445",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EdgeMAX",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.8.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service (CWE-400)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7",
              "refsource": "MISC",
              "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2019-5445",
    "datePublished": "2019-07-10T19:45:09",
    "dateReserved": "2019-01-04T00:00:00",
    "dateUpdated": "2024-08-04T19:54:53.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-12590 (GCVE-0-2018-12590)

Vulnerability from nvd – Published: 2018-06-20 12:00 – Updated: 2024-09-16 22:55
VLAI?
Summary
Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:38:06.333Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/311884"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-20T12:00:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/311884"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-12590",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/311884",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/311884"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-12590",
    "datePublished": "2018-06-20T12:00:00Z",
    "dateReserved": "2018-06-20T00:00:00Z",
    "dateUpdated": "2024-09-16T22:55:54.622Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}