CVE-2023-7209 is a denial of service flaw in Uniway routers through the device_reset.cgi handler. It scores 7.5 (High) and needs no login. The vendor did not respond to the reporter and the record names no fix, so keep the admin interface off the internet.
What's affected
Affected: the record lists the Uniway UW-302VP and UW-301VPW routers and their firmware, and the description says Uniway Router up to 2.0. The vulnerable component is the Device Reset Handler at /boaform/device_reset.cgi.
Fixed: none named. The description says the vendor was contacted early and did not respond. The record says the exploit has been disclosed publicly. KEV is false, and I found no source stating real world exploitation.
The vector is network reachable, low complexity, no privileges and no user interaction, with the entire impact on availability. The weakness class is CWE-404, improper resource shutdown or release.
How to check if you're exposed
Open the router's admin page and read the model and firmware version. If it is a UW-302VP or UW-301VPW, assume you are affected.
Then check exposure. From a machine outside your network, see whether the router's admin interface answers on its public address. If it does, remove that exposure first, because this bug needs only network reach.
What to do now
- Disable remote management on the router, or restrict it to a management network or VPN.
- Check Uniway's support channels for firmware newer than the version you run. The record names none.
- Put the router behind a firewall that drops requests to its admin paths from untrusted networks.
- Plan for outages: keep a spare device or a documented reset procedure, since the impact is loss of service.
- If the model is end of life with no vendor response, schedule a replacement.
Why it matters
The impact here is availability. A single unauthenticated request to a reset handler can take the device down. For a small office or a remote site, that can mean losing connectivity until someone reboots or reconfigures it. There is no data theft in the vector, but repeated outages are a real cost.
For a business, the useful question is what depends on the router. Phones, payment terminals, door systems and remote access often share one uplink. Knowing that list tells you how much a few minutes of downtime would cost, and whether a spare device is worth keeping on the shelf. A cheap spare with a saved configuration turns an outage from a long investigation into a quick swap.
The broader point is that management endpoints on embedded devices often have no authentication checks of their own. Network placement is the control you can apply today.
Quick check
Does the attacker need a password for CVE-2023-7209?
No. The vector shows no privileges required.
What does the attacker gain?
Per the vector, the impact is on availability only: the device can be forced offline. No confidentiality or integrity impact is scored.
Sources
Last reviewed: 19 October 2026.
