PT-2023-5071 · Milesight · Milesight Ur32L

Francesco Benvenuto · Published 2023-07-06 · Updated 2023-08-02 · CVE-2023-25102

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Milesight UR32L version 32.3.0.5

Description Multiple buffer overflow vulnerabilities exist in the vtysh ubus binary due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities. This buffer overflow occurs in the set dmvpn function with the hub ip and the hub gre ip variables.

Recommendations As a temporary workaround, consider disabling the set dmvpn function until a patch is available. Restrict access to the vtysh ubus binary to minimize the risk of exploitation. Avoid using the hub ip and hub gre ip variables in the affected HTTP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

BDU:2023-05631

CVE-2023-25102

Affected Products

Milesight Ur32L

References · 7

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-25102 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25102 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05631 · Security Note
• https://t.me/cvenotify/54064 · Telegram Post
• https://vuldb.com/ru/?id.233195 · Note
• https://t.me/cibsecurity/66125 · Telegram Post