CVE-2023-25103

CVE-2023-25103 concerns Milesight UR32L firmware (v32.3.0.5). The Red Hat/Cisco Talos advisories and vendor data describe multiple buffer-overflow vulnerabilities in the vtysh_ubus/DMVPN set_dmvpn code path, triggered by specially crafted HTTP requests. The overflow arises from unsafe use of spri...

CVE-2023-25101

Milesight UR32L (v32.3.0.5) is affected by CVE-2023-25101 due to buffer overflow in the vtysh_ubus set_dmvpn path (gre_key) caused by unsafe sprintf usage. A high-privilege attacker can trigger via specially crafted HTTP requests to the /vtysh_ubus interface, potentially leading to arbitrary code...

CVE-2023-25110

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25110

Milesight UR32L (v32.3.0.5) is affected by multiple buffer-overflow vulnerabilities in the vtysh_ubus binary caused by unsafe use of sprintf; a specially crafted HTTP request can trigger a remote code-execution path in set_gre and related code paths that format commands via vtysh_command_buffer. ...

CVE-2023-25101

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25103

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25109

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25108

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25109

CVE-2023-25109 describes multiple buffer overflow vulnerabilities in the Milesight UR32L v32.3.0.5, specifically in the vtysh_ubus binary. The root cause is an unsafe sprintf pattern that can overflow a local buffer during processing of HTTP-triggered requests via the UR32L’s /cgi-like interface....

CVE-2023-25108

Vulnerability: CVE-2023-25108 affects Milesight UR32L v32.3.0.5 via the vtysh_ubus binary. Root cause: unsafe use of sprintf in the set_gre path (remote_ip) leading to stack-based buffer overflow. Impact: arbitrary code execution with high risk when an attacker with high privileges sends crafted ...

CVE-2023-25105

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25102

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25102

Milesight UR32L v32.3.0.5 is affected by a set of buffer overflow vulnerabilities in the vtysh_ubus binary, as detailed in TALOS-2023-1716. The root cause is an unsafe sprintf pattern used to compose commands, notably in functions including set_dmvpn, and in various VPN/openvpn related handlers. ...

CVE-2023-25103

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25104

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25111

CVE-2023-25111 affects Milesight UR32L v32.3.0.5. The vulnerability is a set of buffer overflows in the vtysh_ubus binary caused by unsafe sprintf usage, enabling an attacker with high privileges to trigger HTTP requests that may lead to arbitrary code execution. The issue prominently centers on ...

CVE-2023-25107

Summary: CVE-2023-25107 describes multiple buffer overflow vulnerabilities in Milesight UR32L v32.3.0.5, specifically in the vtysh_ubus binary. The root cause across related reports is unsafe use of sprintf-style formatting that directly incorporates user-controlled data, enabling remote attacker...

CVE-2023-25102

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25090

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25093

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...