CVE-2023-25085

CVE-2023-25085 affects Milesight UR32L (v32.3.0.5) with multiple buffer overflow vulnerabilities in the vtysh_ubus firewall_handler_set handling. The Red Hat/RedHat CVE writeups and Talos report describe an unsafe sprintf pattern used when parsing JSON keys (e.g., src/dmz, old_mac/old_ip, ip, mac...

CVE-2023-25085

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25083

CVE-2023-25083 affects Milesight UR32L (v32.3.0.5). The issue is a buffer overflow in the vtysh_ubus firewall_handler_set path, caused by unsafe use of sprintf with user-controlled data (ip, mac, and related fields). The vulnerability is exploitable via crafted HTTP requests and can lead to arbit...

CVE-2023-25086

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25085

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25087

CVE-2023-25087 affects Milesight UR32L v32.3.0.5. The issue is a buffer overflow in the vtysh_ubus binary’s firewall_handler_set path, caused by unsafe use of sprintf with user-controlled data. Exploitation requires an authenticated, high-privilege attacker sending crafted HTTP requests to the af...

CVE-2023-25083

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-24019

CVE-2023-24019 affects Milesight UR32L. A pre-authentication, network-accessible, stack-based buffer overflow exists in the UR32L HTTP server (urvpn_client http_connection_readcb), allowing remote code execution or a crash when processing crafted packets. Connected documents cite TALOS advisories...

CVE-2023-24019

A stack-based buffer overflow vulnerability exists in the urvpnclient httpconnectionreadcb functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to a buffer overflow. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2023-25582

CVE-2023-25582 affects Milesight UR32L v32.3.0.5 with two OS command injection flaws in the zebra vlan_name functionality. Public material documents a pre-authentication remote exploit path in UR32L’s HTTP server (via TALOS-2023-1697) leading to stack-based buffer overflow and potential RCE; addi...

CVE-2023-25583

Two OS command injection vulnerabilities exist in the zebra vlanname functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the code branch...

CVE-2023-24019

A stack-based buffer overflow vulnerability exists in the urvpnclient httpconnectionreadcb functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to a buffer overflow. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2023-25583

Two OS command injection vulnerabilities exist in the zebra vlanname functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the code branch...

CVE-2023-25582

Two OS command injection vulnerabilities exist in the zebra vlanname functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the code branch...

CVE-2023-25583

Milesight UR32L (v32.3.0.5) has two OS command injection vulnerabilities in the zebra vlan_name function. A specially crafted network request can trigger arbitrary command execution on the device. The issues are documented across multiple sources (NVD, Red Hat) and are tied to the UR32L HTTP/web/...

CVE-2023-25582

Two OS command injection vulnerabilities exist in the zebra vlanname functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the code branch...

Milesight UR32L 路径遍历漏洞

The Milesight UR32L is a 4G industrial router from China's Milesight. The Milesight UR32L suffers from a directory traversal vulnerability that can be exploited by an attacker to view arbitrary files on the system by sending a specially crafted URL request containing a "dot dot" sequence /.../. /...

Milesight UR32L 操作系统命令注入漏洞

The Milesight UR32L is a 4G industrial router from China's Milesight. A command injection vulnerability exists in the Milesight UR32L vtyshubus getfwlogs function, which can be exploited by an attacker to execute arbitrary commands on the system...

Milesight UR32L 缓冲区错误漏洞

The Milesight UR32L is a 4G industrial router from China's Milesight. A buffer overflow vulnerability exists in the Milesight UR32L firewallhandlerset function due to incorrect boundary checking in the firewallhandlerset function. An authenticated, remote attacker could use this vulnerability to...

Milesight UR32L 操作系统命令注入漏洞

The Milesight UR32L is a 4G industrial router from China's Milesight. A command injection vulnerability exists in the Milesight UR32L libzebra.so changehostname function, which can be exploited by an attacker to execute arbitrary commands on the system...