PT-2023-5085 · Milesight · Milesight Ur32L

Francesco Benvenuto

·

Published

2023-07-06

·

Updated

2023-08-02

·

CVE-2023-25091

CVSS v2.0

8.3

High

VectorAV:N/AC:L/Au:M/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Milesight UR32L version 32.3.0.5
Description The issue is caused by a buffer overflow vulnerability in the handle interface acl function of the vtysh ubus binary, due to the use of an unsafe sprintf pattern. This can be triggered by a specially crafted HTTP request, potentially leading to arbitrary code execution. The buffer overflow occurs with the interface variable when out acl is -1. An attacker with high privileges can send HTTP requests to exploit this vulnerability.
Recommendations For Milesight UR32L version 32.3.0.5, as a temporary workaround, consider disabling the handle interface acl function until a patch is available. Restrict access to the vtysh ubus binary to minimize the risk of exploitation. Avoid using the interface variable in affected HTTP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Memory Corruption

Weakness Enumeration

Related Identifiers

BDU:2023-05645
CVE-2023-25091

Affected Products

Milesight Ur32L