PT-2023-5178 · Milesight · Milesight Ur32L

Francesco Benvenuto

·

Published

2023-07-06

·

Updated

2023-08-02

·

CVE-2023-25114

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Milesight UR32L version 32.3.0.5
Description The issue is caused by multiple buffer overflow vulnerabilities in the vtysh ubus binary due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. This buffer overflow occurs in the set openvpn client function with the expert options variable. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities, potentially allowing a remote attacker to execute arbitrary code.
Recommendations For Milesight UR32L version 32.3.0.5, consider disabling the set openvpn client function until a patch is available to prevent exploitation of the buffer overflow vulnerability. Restrict access to the vtysh ubus binary and limit the ability to send crafted HTTP requests to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Stack Overflow

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2023-05770
CVE-2023-25114

Affected Products

Milesight Ur32L