CVE-2023-31998 - A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices

Back Back to CVE browser

HIGH

A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices

Published Jul 18, 2023

7.5

HIGH

CVSS 3.1

EPSS 0.80%

Description

A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices.

Affected products

Vendor Ubiquiti Product Aircube Default
unaffected
- Version
  2.8.8
  Status
  affected
  Constraints
  <=2.8.8
Vendor Ubiquiti Product EdgeRouter Default
unaffected
- Version
  2.0.9-hotfix.6
  Status
  affected
  Constraints
  <=2.0.9-hotfix.6

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Ubiquiti

Aircube

unaffected

Version	Status	Constraints
2.8.8	affected	<=2.8.8

Ubiquiti

EdgeRouter

unaffected

Version	Status	Constraints
2.0.9-hotfix.6	affected	<=2.0.9-hotfix.6

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-120

Classic Buffer Overflow

CWE-787

Out-of-bounds Write

References (1)

https://community.ui.com/releases/Security-Advisory-Bulletin-033-033/17f7c7c0-830b-4625-a2ee-e90e514e7b0f
PatchVendor Advisory

Link	Providers	Tags
https://community.ui.com/releases/Security-Advisory-Bulletin-033-033/17f7c7c0-830b-4625-a2ee-e90e514e7b0f		PatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner hackerone

Published Jul 18, 2023

Updated Oct 29, 2024

Reserved May 1, 2023

Link CVE-2023-31998

CISA Vulnrichment

Updated Oct 21, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-31998

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-31998