CVE-2022-43553

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-05 · updated 2026-06-17
Weakness: CWE-250

Description

A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account to run arbitrary administrator commands.This vulnerability is fixed in Version 2.0.9-hotfix.5 and later.

Affected products

EdgeMAX EdgeRouter: before 2.0.9; 2.0.9, 2.0.9-hotfix1, 2.0.9-hotfix2, 2.0.9-hotfix4 — fixed in 2.0.9

How to fix

Upgrade to a fixed version: EdgeMAX EdgeRouter 2.0.9. Check the vendor advisory for mitigations.

References

https://community.ui.com/releases/Security-Advisory-Bulletin-026-026/07697c65-30b3-4c06-a158-35e06534480d
https://community.ui.com/releases/Security-Advisory-Bulletin-026-026/07697c65-30b3-4c06-a158-35e06534480d

Get alerted when CVE-2022-43553 or the next vulnerability affects your stack