CVE-2023-7211 is a weakness in the administrative web interface of Uniway routers, which relies on an IP address for authentication. It scores 5.6 (Medium) because exploitation is rated difficult. The vendor did not respond and no fix is named, so restrict who can reach the interface.
What's affected
Affected: the record lists the Uniway UW-302VP and UW-301VPW routers, and the description says Uniway Router 2.0. The component is the Administrative Web Interface.
Fixed: none named. The description notes the vendor was contacted early and did not respond. The record says the exploit has been disclosed publicly, while also noting the complexity is rather high and exploitation appears difficult. KEV is false.
The weaknesses are CWE-291 (reliance on IP address for authentication) and CWE-287 (improper authentication). The vector has high attack complexity, which is why the score is in the medium band despite no privileges and no user interaction.
How to check if you're exposed
Read the model and firmware version from the router's admin page. Then check which networks can reach that page. If your admin interface trusts requests because of the source address, any device that can appear to come from a trusted address may be treated as trusted.
Also confirm the admin page is not exposed to the internet from outside your network.
What to do now
- Restrict the admin interface to a dedicated management network or a VPN. Do not rely on source addresses alone.
- Check Uniway's support site for new firmware. The record names no fixed release.
- Segment the network so untrusted devices cannot reach the router's management address.
- Use a strong unique admin password where the device supports one.
- If there is no vendor response, plan a replacement.
Why it matters
Source addresses are easy to claim and hard to verify across a network. An IP address says where a packet says it came from, not who sent it. Authentication that rests on it is weak whenever an attacker can get close enough to the device or the traffic path.
The lesson is old but still true: authenticate a person or a device with a secret, and use network location only as an extra layer.
In practice, review any device that has a management page and ask one question: if someone else sat on a trusted address, what would the device let them do? Routers, cameras and small appliances often answer with more than their owners expect. Moving management to a separate network, and logging who connects to it, closes most of that gap even when the firmware cannot be changed.
Quick check
Why is the score only 5.6?
The vector has high attack complexity. The record describes exploitation as difficult.
Is it related to CVE-2023-7209?
Same product line and disclosure date, different flaw. CVE-2023-7209 is a denial of service in the reset handler.
Sources
Last reviewed: 19 October 2026.
