CVE-2017-0933 Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from a Cross-Site Request Forgery (CSRF) vulnerability. An attacker with access to an operator (read-only) account could lure an admin (root) us...
HighCVSS 8.0
EPSS 0.54%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from a Cross-Site Request Forgery (CSRF) vulnerability. An attacker with access to an operator (read-only) account could lure an admin (root) user to access the attacker-controlled page, allowing the attacker to gain admin privileges in the system.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ubnt edgeos | <= 1.9.1 | No fix listed |
| ubiquiti networks EdgeRouter X | = EdgeOS v1.9.1 and prior | No fix listed |
References
- community.ubnt.com patch vendor-advisory
- hackerone.com third-party-advisory