CVE-2023-23571

An access violation vulnerability exists in the eventcore functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to denial of service. An attacker can send a network request to trigger this vulnerability...

CVE-2023-23571

Milesight UR32L vulnerability CVE-2023-23571 is a pre-authentication access violation in the eventcore component (v32.3.0.5) that can be triggered by a crafted network request, resulting in a denial of service. Talos documentation confirms the UR32L’s eventcore/HTTP server Binary vulnerabilities,...

CVE-2023-22306

An OS command injection vulnerability exists in the libzebra.so bridgegroup functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2023-22844

An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a network request to trigger this vulnerability...

CVE-2023-22659

Milesight UR32L (v32.3.0.5) contains CVE-2023-22659: an OS command injection vulnerability in the libzebra.so change_hostname function. Talos reports a pre-authentication stack-based buffer overflow in the UR32L HTTP server binary uhttpd, specifically in decrypt_string, where Base64-decode then A...

CVE-2023-22659

An os command injection vulnerability exists in the libzebra.so changehostname functionality of Milesight UR32L v32.3.0.5. A specially-crafted network packets can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2023-22659

An os command injection vulnerability exists in the libzebra.so changehostname functionality of Milesight UR32L v32.3.0.5. A specially-crafted network packets can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2023-22844

Milesight VPN (v2.0.2) suffers an authentication bypass in the requestHandlers.js verifyToken flow. Talos documents a vulnerability (CVE-2023-22844) where a JWT forged with static private/public keys can be accepted due to predictable key material, allowing an attacker to bypass login and gain ad...

CVE-2023-22319

A sql injection vulnerability exists in the requestHandlers.js LoginAuth functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2023-22319

A sql injection vulnerability exists in the requestHandlers.js LoginAuth functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2023-23907

A directory traversal vulnerability exists in the server.js start functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to arbitrary file read. An attacker can send a network request to trigger this vulnerability...

CVE-2023-23907

Milesight VPN / MilesightVPN (v2.0.2) has a directory traversal vulnerability in the server.js start path handling. TALOS-2023-1702 describes an unauthenticated path traversal: unvalidated construction of realPath (path.join(__dirname, '../'+pathname)) can allow reading arbitrary files via crafte...

CVE-2023-22319

Milesight VPN v2.0.2 is affected by CVE-2023-22319: SQL injection in LoginAuth (requestHandlers.js) that bypasses authentication. The query is built via string concatenation, enabling an attacker to craft a network request to log in as a legitimate user and obtain a session token. TALOS confirms ...

CVE-2023-22371

CVE-2023-22371 is an OS command-injection vulnerability in Milesight VPN v2.0.2, exposed via MilesightVPN liburvpn.so create_private_key used during /Device_Auth. An attacker who obtains a valid authorization code can trigger the vulnerability by sending crafted data to the API; the code path eve...

CVE-2023-24497

Cross-site scripting xss vulnerabilities exist in the requestHandlers.js detaildevice functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploite...

CVE-2023-24497

Milesight VPN v2.0.2 contains cross-site scripting (XSS) vulnerabilities in the requestHandlers.js detail_device flow (CVE-2023-24497). Talos documents that XSS is introduced when a device is registered via Device_Auth, with user-controlled data stored in the device table (notably the remote_subn...

CVE-2023-24496

Milesight VPN v2.0.2 is affected by cross-site scripting in the Device_Auth flow. Talos documents CVE-2023-24496 (XSS via device_name stored in device.name) and CVE-2023-24497 (XSS via subnet stored in device.remote_subnet). An attacker can register a device with crafted inputs, which are stored ...

CVE-2023-24496

Cross-site scripting xss vulnerabilities exist in the requestHandlers.js detaildevice functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploite...

CVE-2023-24496

Cross-site scripting xss vulnerabilities exist in the requestHandlers.js detaildevice functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploite...

CVE-2023-22371

An os command injection vulnerability exists in the liburvpn.so createprivatekey functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to command execution. An attacker can send a malicious packet to trigger this vulnerability...