CVE-2023-23912: Code Injection
A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix delegation set to dhcpv6-stateless or dhcpv6-stateful, allows a malicious actor directly connected to the WAN interface of an affected device to create a remote code execution vulnerability.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-23912?
CVE-2023-23912 is a vulnerability found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix delegation set to dhcpv6-stateless or dhcpv6-stateful, allowing a malicious actor to directly connect to the WAN interface of the affected device.
How severe is CVE-2023-23912?
CVE-2023-23912 has a severity rating of 8.8, which is considered high.
How can I fix CVE-2023-23912?
To fix CVE-2023-23912, update your EdgeRouters to Version 2.0.9-hotfix.6 or later, or update your UniFi Security Gateways (USG) to Version 4.4.57 or later.
Is my device affected by CVE-2023-23912?
If you are using EdgeRouters Version 2.0.9-hotfix.5 or earlier, or UniFi Security Gateways (USG) Version 4.4.56 or earlier with DHCPv6 prefix delegation set to dhcpv6-stateless or dhcpv6-stateful, then your device is affected by CVE-2023-23912.
Where can I find more information about CVE-2023-23912?
You can find more information about CVE-2023-23912 in the security advisory bulletin released by the community.ui.com. Please refer to the following link: [Security Advisory Bulletin](https://community.ui.com/releases/Security-Advisory-Bulletin-028-028/696e4e3b-718c-4da4-9a21-965a85633b5f).