964 matches found
CVE-2023-25110
Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...
CVE-2023-24496
Cross-site scripting xss vulnerabilities exist in the requestHandlers.js detaildevice functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploite...
CVE-2023-43261
An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components...
CVE-2016-2358
Milesight IP security cameras through 2016-11-14 have a default set of 10 privileged accounts with hardcoded credentials. They are accessible if the customer has not configured 10 actual user accounts...
CVE-2025-4043
CVE-2025-4043 affects Milesight UG65-868M-EA gateways (pre-60.0.0.46 firmware). An admin user can gain unauthorized write access to /etc/rc.local, which is executed at system boot, enabling persistence. Public documents describe risk as admin-command injection by a privileged user (CISA ICS advis...
CVE-2025-4043 Milesight UG65-868M-EA Improper Access Control for Volatile Memory Containing Boot Code
An admin user can gain unauthorized write access to the /etc/rc.local file on the device, which is executed on a system boot...
CVE-2025-4043 Milesight UG65-868M-EA Improper Access Control for Volatile Memory Containing Boot Code
An admin user can gain unauthorized write access to the /etc/rc.local file on the device, which is executed on a system boot...
Milesight UG65-868M-EA 安全漏洞
The Milesight UG65-868M-EA is a ruggedized indoor and semi-outdoor LoRaWAN gateway from China-based Milesight. A security vulnerability exists in the Milesight UG65-868M-EA prior to version 60.0.0.46, which originates from an administrator user being able to write unauthorized access to the...
CISA Releases Three Industrial Control Systems Advisories
CISA released three Industrial Control Systems ICS advisories on May 6, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-126-01 Optigo Networks ONS NC600 ICSA-25-126-02 Milesight UG65-868M-EA ICSA-25-126-03...
PT-2025-19998 · Milesight · Milesight Ug65-868M-Ea
Name of the Vulnerable Software and Affected Versions: Milesight UG65-868M-EA gateway affected versions not specified Description: A new issue in the Milesight industrial gateway could potentially impact critical infrastructure. The estimated number of potentially affected devices worldwide is no...
Unauthenticated local file disclosure on Milesight DeviceHub
TL;DR Nginx container on Milesight DeviceHub includes MQTT private key store Can download MQTT private keys across network Milesight eventually responded and issued a firmware update Unauthenticated local file disclosure on Milesight DeviceHub CVSS: 6.5 Medium CVSS:3.1:...
The vulnerability of the MileSight DeviceHub deployment platform, caused by an incorrect path name limitation for accessing the restricted catalog, allows a violator to execute arbitrary code.
The vulnerability of the MileSight DeviceHub deployment platform exists due to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
The vulnerability of the MileSight DeviceHub deployment platform, related to authentication errors, allows a violator to execute arbitrary code.
The vulnerability of the MileSight DeviceHub deployment platform is related to authentication errors. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
The vulnerability of the MileSight DeviceHub deployment platform, related to key management errors, allows a violator to carry out a “man-in-the-middle” attack.
The vulnerability of the MileSight DeviceHub deployment platform is related to key management errors. Exploiting this vulnerability could allow a remote attacker to carry out a “man-in-the-middle” attack...
The vulnerability of the MileSight DeviceHub deployment platform, related to the use of insufficiently random values, allows a violator to execute arbitrary code.
The vulnerability of the MileSight DeviceHub deployment platform lies in the use of insufficiently random values. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
The vulnerability of the MileSight DeviceHub deployment platform, which stems from insufficient validation of input data, allows a violator to trigger a service failure.
The vulnerability of the MileSight DeviceHub deployment platform exists due to insufficient verification of input data. Exploiting this vulnerability could allow a remote attacker to cause service failures...
CVE-2024-36390
MileSight DeviceHub - CWE-20 Improper Input Validation may allow Denial of Service...
CVE-2024-36391
MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic...
