CVE-2023-7209VulnerabilityPublished 7 Jan 2024Updated 3 Jun 2025

CVE-2023-7209: Uniway Router · Denial of Service

Affects Uniway RouterSource CVE Database V5

Not known to be exploited · CVSS 7.5 High.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 1.2% chance of exploitation in 30 days – higher than 70% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 7 Jan 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Uniway Router	Affected =2.0	Fixed in–

AI-suggested

Given the lack of official patches, European organizations should implement the following specific mitigations: 1) Network segmentation: Isolate Uniway routers from critical network segments and sensitive systems to limit the blast radius of a potential DoS attack. 2) Access control: Restrict access to the /boaform/device_reset.cgi endpoint by implementing firewall rules or web application firewalls (WAFs) that block or rate-limit requests to this CGI path, especially from untrusted networks or the internet. 3) Monitoring and alerting: Deploy network monitoring tools to detect unusual traffic patterns or repeated requests targeting the vulnerable endpoint, enabling rapid detection of exploitation attempts. 4) Incident response planning: Prepare response playbooks for DoS scenarios involving Uniway routers, including fallback connectivity options and rapid device replacement strategies. 5) Vendor engagement: Continue efforts to contact Uniway for patch releases or official guidance, and consider alternative hardware vendors if the risk remains unmitigated. 6) Firmware upgrade policies: Regularly review and update router firmware when patches become available, and maintain an inventory of affected devices to prioritize remediation.

Description

A vulnerability was found in Uniway Router up to 2.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boaform/device_reset.cgi of the component Device Reset Handler. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249758 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Impact

For European organizations, the impact of this vulnerability can be significant, especially for those relying on Uniway routers in their network infrastructure. A successful DoS attack could disrupt critical business operations by causing network outages, impacting internet access, intranet connectivity, and potentially interrupting services dependent on continuous network availability. This could affect sectors such as finance, healthcare, manufacturing, and public services where network uptime is crucial. Additionally, the remote and unauthenticated nature of the exploit lowers the barrier for attackers, increasing the likelihood of opportunistic attacks or targeted disruption campaigns. The absence of vendor patches means organizations must rely on alternative mitigations, increasing operational complexity and risk exposure. Furthermore, denial of service attacks can be used as a smokescreen for other malicious activities, complicating incident response efforts.

Summary

CVE-2023-7209 is a critical vulnerability affecting Uniway Router devices running firmware version 2.0. The issue resides in the device reset handler component, specifically within the /boaform/device_reset.cgi endpoint. This vulnerability is classified under CWE-404, which corresponds to an improper resource shutdown or release, leading to a denial of service (DoS) condition. An attacker can remotely exploit this vulnerability without requiring any authentication or user interaction, by sending specially crafted requests to the vulnerable CGI endpoint. Successful exploitation results in the router becoming unresponsive or crashing, effectively disrupting network connectivity and availability. The vulnerability has been publicly disclosed, although no patches or vendor responses have been provided to date. The CVSS v3.1 base score is 7.5, indicating a high severity level, with the vector highlighting that the attack can be launched remotely (AV:N), requires no privileges (PR:N), no user interaction (UI:N), and impacts availability only (A:H) without affecting confidentiality or integrity. The lack of vendor response and absence of patches increases the risk for affected organizations, as attackers could develop exploits to cause network outages or degrade service reliability.

CWE-404Improper Resource Shutdown or Release (opens in a new tab)
Class weaknessLikelihood of exploit: Medium
The product does not release or incorrectly releases a resource before it is made available for re-use.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Implementation
It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error…
Implementation
Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].
Attack patterns
TCP Fragmentation (opens in a new tab)
UDP Fragmentation (opens in a new tab)
ICMP Fragmentation (opens in a new tab)
BlueSmacking (opens in a new tab)
Flooding (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 4 Jul 2025, 01:40 UTC

WeaknessesCWE-404

Technical details

References

Community reviews

Related threats