CVE-2023-24019

2023-07-0615:15:11

CWE-120

CWE-787

[email protected]

web.nvd.nist.gov

buffer overflow

network packet

urvpn_client

milesight ur32l

cve-2023-24019

vulnerability

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

52.5%

JSON

A stack-based buffer overflow vulnerability exists in the urvpn_client http_connection_readcb functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to a buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.

Affected configurations

Nvd

Node

milesightur32lMatch-

AND

milesightur32l_firmwareMatch32.3.0.5

VendorProductVersionCPE
milesightur32l-cpe:2.3:h:milesight:ur32l:-:*:*:*:*:*:*:*
milesightur32l_firmware32.3.0.5cpe:2.3:o:milesight:ur32l_firmware:32.3.0.5:*:*:*:*:*:*:*