CVE-2022-43553

Published: Dec 5, 2022Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account to run arbitrary administrator commands.This vulnerability is fixed in Version 2.0.9-hotfix.5 and later.

Affected (5)

Products: Ui: Edgemax Edgerouter Firmware

1 product

Edgemax Edgerouter Firmware

Configuration A

5 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ui Edgemax Edgerouter Firmware	Before 2.0.9
Ui Edgemax Edgerouter Firmware	Version 2.0.9
Ui Edgemax Edgerouter Firmware	Version 2.0.9 hotfix1
Ui Edgemax Edgerouter Firmware	Version 2.0.9 hotfix2
Ui Edgemax Edgerouter Firmware	Version 2.0.9 hotfix4

Running on/with	Platform Versions
Ui Edgemax Edgerouter	All versions

Related CWEs

CWE-250

Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

References (2)

https://community.ui.com/releases/Security-Advisory-Bulletin-026-026/07697c65-30b3-4c06-a158-35e06534480d

Source: support@hackerone.com

Vendor Advisory

https://community.ui.com/releases/Security-Advisory-Bulletin-026-026/07697c65-30b3-4c06-a158-35e06534480d

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.