CVE-2019-5426 - In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dynamic port forwarding" (SOCKS proxy) functionalities

Back Back to CVE browser

MEDIUM

In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dynamic port forwarding" (SOCKS proxy) functionalities

Published Apr 10, 2019

4.8

MEDIUM

CVSS 3.1

EPSS 0.81%

Description

In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dynamic port forwarding" (SOCKS proxy) functionalities. Remote attackers without credentials can exploit this bug to access local services or forward traffic through the device if SSH is enabled in the system settings.

Affected products

Vendor Ubiquiti Networks Product EdgeMAX Default
n/a
- Version
  EdgeSwitch X prior to v1.1.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Ubiquiti Networks

EdgeMAX

n/a

Version	Status	Constraints
EdgeSwitch X prior to v1.1.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (2)

https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeSwitch-X-software-release-v1-1-1/ba-p/2731137
x_refsource_CONFIRMPatchVendor Advisory
https://hackerone.com/reports/512958
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeSwitch-X-software-release-v1-1-1/ba-p/2731137		x_refsource_CONFIRMPatchVendor Advisory
https://hackerone.com/reports/512958		x_refsource_MISCThird Party Advisory