964 matches found
CVE-2023-22365
CVE-2023-22365 covers a set of OS command injection vulnerabilities in Milesight UR32L (v32.3.0.5) affecting the ys_thirdparty check_system_user function and related UR32L/Talos-disclosed JO vulnerabilities. Talos documents a pre-authentication remote stack-based buffer overflow (TALOS-2023-1697,...
CVE-2023-24583
Summary (CVE-2023-24583) : Cisco Talos details two OS command injection flaws in Milesight UR32L v32.3.0.5 related to the urvpn_client’s command handling (execute_urvpn_command and cmd_name_action). An attacker can trigger arbitrary command execution by sending crafted JSON via UDP (and via TCP i...
CVE-2023-24582
Two OS command injection vulnerabilities exist in the urvpnclient cmdnameaction functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This OS command injectio...
CVE-2023-22365
An OS command injection vulnerability exists in the ysthirdparty checksystemuser functionality of Milesight UR32L v32.3.0.5. A specially crafted set of network packets can lead to command execution. An attacker can send a network request to trigger this vulnerability...
CVE-2023-24582
Two OS command injection vulnerabilities exist in the urvpnclient cmdnameaction functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This OS command injectio...
CVE-2023-24582
Milesight UR32L has two OS command injection flaws in the urvpn_client cmd_name_action path (CVE-2023-24582 and CVE-2023-24583). A JSON-driven command can be delivered over TCP/UDP to reach execute_urvpn_command, which calls cmd_name_action, then constructs a shell command and invokes system() wi...
CVE-2023-24595
An OS command injection vulnerability exists in the ysthirdparty systemuserscript functionality of Milesight UR32L v32.3.0.5. A specially crafted series of network requests can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability...
CVE-2023-22653
An OS command injection vulnerability exists in the vtyshubus tcpdumpstartcb functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to command execution. An authenticated attacker can send an HTTP request to trigger this vulnerability...
CVE-2023-24595
An OS command injection vulnerability exists in the ysthirdparty systemuserscript functionality of Milesight UR32L v32.3.0.5. A specially crafted series of network requests can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability...
CVE-2023-24595
Milesight UR32L vulnerability CVE-2023-24595 is an OS command injection in the ys_thirdparty system_user_script function. Talos and CNVD describe that a specially crafted sequence of network requests can trigger command execution, enabling an attacker to run arbitrary commands on the device. Affe...
CVE-2023-22653
CVE-2023-22653 : Milesight UR32L v32.3.0.5 exposes an OS command injection in the vtysh_ubus tcpdump_start_cb API. Cisco Talos details show an authenticated, pre-auth vulnerability where a specially crafted HTTP request can trigger command execution via the tcpdump_start functionality, potentiall...
CVE-2023-22653
An OS command injection vulnerability exists in the vtyshubus tcpdumpstartcb functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to command execution. An authenticated attacker can send an HTTP request to trigger this vulnerability...
CVE-2023-24018
CVE-2023-24018 affects Milesight UR32L v32.3.0.5. Talos reports a stack-based buffer overflow in the libzebra.so.0.0.0 security_decrypt_password function used to decrypt user passwords during configuration (e.g., via the yruo_usermanagement path). The vulnerability arises from decrypting an arbit...
CVE-2023-25124
Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...
CVE-2023-25124
CVE-2023-25124 (Milesight UR32L v32.3.0.5) is a set of buffer overflow vulnerabilities in the vtysh_ubus binary and related OpenVPN client handling. Talos documents a pre-authentication remote risk path via crafted requests that can trigger stack-based buffer overflows in functions such as set_op...
CVE-2023-25123
Milesight UR32L v32.3.0.5 is affected by CVE-2023-25123 due to multiple buffer overflow vulnerabilities in the vtysh_ubus binary. The root cause is an unsafe sprintf usage that concatenates user-controlled data into vtysh_command_buffer, triggered through high-privilege HTTP requests to the OpenV...
CVE-2023-24018
A stack-based buffer overflow vulnerability exists in the libzebra.so.0.0.0 securitydecryptpassword functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to a buffer overflow. An authenticated attacker can send an HTTP request to trigger this vulnerability...
CVE-2023-25123
Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...
CVE-2023-25124
Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...
CVE-2023-24018
A stack-based buffer overflow vulnerability exists in the libzebra.so.0.0.0 securitydecryptpassword functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to a buffer overflow. An authenticated attacker can send an HTTP request to trigger this vulnerability...