CVE-2023-23546

A misconfiguration vulnerability exists in the urvpnclient functionality of Milesight UR32L v32.3.0.5. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

CVE-2023-24519

Milesight UR32L (v32.3.0.5) contains OS command injection vulnerabilities in the vtysh_ubus toolsh_excute.constprop.1 function, affecting the router’s HTTP/UBUS interfaces. Talos identifies two CVEs (CVE-2023-24519, CVE-2023-24520) linked to pre-authentication, stack-based command execution via p...

CVE-2023-24583

Two OS command injection vulnerabilities exist in the urvpnclient cmdnameaction functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This OS command injectio...

CVE-2023-24583

Two OS command injection vulnerabilities exist in the urvpnclient cmdnameaction functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This OS command injectio...

CVE-2023-22299

Milesight UR32L in v32.3.0.5 is affected by CVE-2023-22299, an OS command injection in the vtysh_ubus fw_logs_get handler exposed via the /cgi API. The vulnerability allows an attacker-supplied command (provided through the blobmsg tb[1] value) to be assembled into an iptables command and execute...

CVE-2023-22299

An OS command injection vulnerability exists in the vtyshubus getfwlogs functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability...

CVE-2023-22365

An OS command injection vulnerability exists in the ysthirdparty checksystemuser functionality of Milesight UR32L v32.3.0.5. A specially crafted set of network packets can lead to command execution. An attacker can send a network request to trigger this vulnerability...

CVE-2023-22299

An OS command injection vulnerability exists in the vtyshubus getfwlogs functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability...

CVE-2023-22365

CVE-2023-22365 covers a set of OS command injection vulnerabilities in Milesight UR32L (v32.3.0.5) affecting the ys_thirdparty check_system_user function and related UR32L/Talos-disclosed JO vulnerabilities. Talos documents a pre-authentication remote stack-based buffer overflow (TALOS-2023-1697,...

CVE-2023-24582

Two OS command injection vulnerabilities exist in the urvpnclient cmdnameaction functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This OS command injectio...

CVE-2023-24583

Summary (CVE-2023-24583) : Cisco Talos details two OS command injection flaws in Milesight UR32L v32.3.0.5 related to the urvpn_client’s command handling (execute_urvpn_command and cmd_name_action). An attacker can trigger arbitrary command execution by sending crafted JSON via UDP (and via TCP i...

CVE-2023-24582

Two OS command injection vulnerabilities exist in the urvpnclient cmdnameaction functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This OS command injectio...

CVE-2023-24582

Milesight UR32L has two OS command injection flaws in the urvpn_client cmd_name_action path (CVE-2023-24582 and CVE-2023-24583). A JSON-driven command can be delivered over TCP/UDP to reach execute_urvpn_command, which calls cmd_name_action, then constructs a shell command and invokes system() wi...

CVE-2023-24595

An OS command injection vulnerability exists in the ysthirdparty systemuserscript functionality of Milesight UR32L v32.3.0.5. A specially crafted series of network requests can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2023-22653

An OS command injection vulnerability exists in the vtyshubus tcpdumpstartcb functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to command execution. An authenticated attacker can send an HTTP request to trigger this vulnerability...

CVE-2023-24595

An OS command injection vulnerability exists in the ysthirdparty systemuserscript functionality of Milesight UR32L v32.3.0.5. A specially crafted series of network requests can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2023-22653

CVE-2023-22653 : Milesight UR32L v32.3.0.5 exposes an OS command injection in the vtysh_ubus tcpdump_start_cb API. Cisco Talos details show an authenticated, pre-auth vulnerability where a specially crafted HTTP request can trigger command execution via the tcpdump_start functionality, potentiall...

CVE-2023-24595

Milesight UR32L vulnerability CVE-2023-24595 is an OS command injection in the ys_thirdparty system_user_script function. Talos and CNVD describe that a specially crafted sequence of network requests can trigger command execution, enabling an attacker to run arbitrary commands on the device. Affe...

CVE-2023-22653

An OS command injection vulnerability exists in the vtyshubus tcpdumpstartcb functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to command execution. An authenticated attacker can send an HTTP request to trigger this vulnerability...

CVE-2023-25124

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...