CVE-2023-24583

2023-07-0615:15:12

CWE-77

talos

web.nvd.nist.gov

cve

2023

24583

os command injection

milesight ur32l

v32.3.0.5

nvd

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.004

Percentile

74.7%

JSON

Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This OS command injection is triggered through a UDP packet.

Affected configurations

Nvd

Vulners

Node

milesightur32l_firmwareMatch32.3.0.5

AND

milesightur32lMatch-

VendorProductVersionCPE
milesightur32l_firmware32.3.0.5cpe:2.3:o:milesight:ur32l_firmware:32.3.0.5:*:*:*:*:*:*:*
milesightur32l-cpe:2.3:h:milesight:ur32l:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
milesight	ur32l_firmware	32.3.0.5	cpe:2.3:o:milesight:ur32l_firmware:32.3.0.5:::::::*
milesight	ur32l	-	cpe:2.3:h:milesight:ur32l:-:::::::*

CNA Affected

[
  {
    "vendor": "Milesight",
    "product": "UR32L",
    "versions": [
      {
        "version": "v32.3.0.5",
        "status": "affected"
      }
    ]
  }
]