CVE-2023-25110

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25109

CVE-2023-25109 describes multiple buffer overflow vulnerabilities in the Milesight UR32L v32.3.0.5, specifically in the vtysh_ubus binary. The root cause is an unsafe sprintf pattern that can overflow a local buffer during processing of HTTP-triggered requests via the UR32L’s /cgi-like interface....

CVE-2023-25108

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25104

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25108

Vulnerability: CVE-2023-25108 affects Milesight UR32L v32.3.0.5 via the vtysh_ubus binary. Root cause: unsafe use of sprintf in the set_gre path (remote_ip) leading to stack-based buffer overflow. Impact: arbitrary code execution with high risk when an attacker with high privileges sends crafted ...

CVE-2023-25106

Milesight UR32L v32.3.0.5 is affected by multiple buffer overflow vulnerabilities in the vtysh_ubus binary, caused by unsafe use of sprintf. The flaws are triggered by crafted HTTP requests (network access) and can lead to arbitrary code execution. The root cause is unsafe pattern usage in variou...

CVE-2023-25104

Milesight UR32L (v32.3.0.5) is affected by CVE-2023-25104 due to a buffer overflow in the vtysh_ubus binary’s set_ike_profile path. The vulnerability stems from an unsafe sprintf pattern used with username and password, allowing a high-privilege attacker to trigger HTTP requests over the network ...

CVE-2023-25111

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25107

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25102

Milesight UR32L v32.3.0.5 is affected by a set of buffer overflow vulnerabilities in the vtysh_ubus binary, as detailed in TALOS-2023-1716. The root cause is an unsafe sprintf pattern used to compose commands, notably in functions including set_dmvpn, and in various VPN/openvpn related handlers. ...

CVE-2023-25103

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25109

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25105

CVE-2023-25105 concerns Milesight UR32L v32.3.0.5 where the vtysh_ubus binary contains a buffer overflow due to an unsafe sprintf pattern. Talos-affiliated analysis documents multiple vulnerable code paths (set_ike_profile, various vtysh_ubus handlers) that construct commands via sprintf with use...

CVE-2023-25103

CVE-2023-25103 concerns Milesight UR32L firmware (v32.3.0.5). The Red Hat/Cisco Talos advisories and vendor data describe multiple buffer-overflow vulnerabilities in the vtysh_ubus/DMVPN set_dmvpn code path, triggered by specially crafted HTTP requests. The overflow arises from unsafe use of spri...

CVE-2023-25101

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25104

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25108

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25110

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25106

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25105

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...