CVE-2019-5426

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dynamic port forwarding" (SOCKS proxy) functionalities. Remote attackers without credentials can exploit this bug to access local services or forward traffic through the device if SSH is enabled in the system settings.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Ubiquiti Networks	EdgeMAX	EdgeSwitch X prior to v1.1.1

References

https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeSwitch-X-software-release-v1-1-1/ba-p/2731137Patch, Vendor Advisory
https://hackerone.com/reports/512958Third Party Advisory
https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeSwitch-X-software-release-v1-1-1/ba-p/2731137Patch, Vendor Advisory
https://hackerone.com/reports/512958Third Party Advisory

Timeline

Published: Apr 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-54277.5c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursi CVE-2019-54297.8Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp' binary in the user's hom CVE-2019-54308.8In UniFi Video 3.10.0 and prior, due to the lack of CSRF protection, it is possible to abuse the Web API to make changes on the server confi CVE-2019-54315.4This vulnerability was caused by an incomplete fix to CVE-2017-0911. Twitter Kit for iOS versions 3.0 to 3.4.0 is vulnerable to a callback v CVE-2019-54327.5A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.CVE-2019-54335.4A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.p CVE-2019-54349.8An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" para CVE-2019-54353.7An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.CVE-2019-54367.8A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.CVE-2019-54375.3Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to CVE-2019-54385.3Path traversal using symlink in npm harp module versions <= 0.29.0.CVE-2019-54396.5A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.