CVE-2023-23912

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix delegation set to dhcpv6-stateless or dhcpv6-stateful, allows a malicious actor directly connected to the WAN interface of an affected device to create a remote code execution vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-75 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Feb 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-239136.3There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are as CVE-2023-239149.1A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multip CVE-2023-239156.5A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorr CVE-2023-239166.5An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algori CVE-2023-239178.8A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any u CVE-2023-239187.5A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experime CVE-2023-239197.5A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL erro CVE-2023-23924.8A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been classified as problematic. Affected is an unknown function of the fi CVE-2023-239204.2An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search a CVE-2023-239216.1The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remot CVE-2023-239226.1The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in blog search. A remote attacker can CVE-2023-239238.2The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set th