Milesight Ur32L vulnerabilities

CVE-2023-23902 [CRITICAL] CWE-121 CVE-2023-23902: A buffer overflow vulnerability exists in the uhttpd login functionality of Milesight UR32L v32.3.0. A buffer overflow vulnerability exists in the uhttpd login functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to remote code execution. An attacker can send a network request to trigger this vulnerability.

CVE-2023-24520 [HIGH] CWE-77 CVE-2023-24520: Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionali Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the trace tool utility.

CVE-2023-24519 [HIGH] CWE-77 CVE-2023-24519: Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionali Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the ping tool utility.

CVE-2023-22299 [HIGH] CWE-78 CVE-2023-22299: An OS command injection vulnerability exists in the vtysh_ubus _get_fw_logs functionality of Milesig An OS command injection vulnerability exists in the vtysh_ubus _get_fw_logs functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability.

CVE-2023-22653 [HIGH] CWE-78 CVE-2023-22653: An OS command injection vulnerability exists in the vtysh_ubus tcpdump_start_cb functionality of Mil An OS command injection vulnerability exists in the vtysh_ubus tcpdump_start_cb functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to command execution. An authenticated attacker can send an HTTP request to trigger this vulnerability.

CVE-2023-24583 [HIGH] CWE-77 CVE-2023-24583: Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This OS command injection is triggered through a UDP packet.

CVE-2023-24582 [HIGH] CWE-77 CVE-2023-24582: Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This OS command injection is triggered through a TCP packet.

CVE-2023-47166 [HIGH] CWE-285 CVE-2023-47166: A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2. A specially crafted network request can lead to arbitrary firmware update. An attacker can send a network request to trigger this vulnerability.

CVE-2023-25582 [HIGH] CWE-78 CVE-2023-25582: Two OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR3 Two OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the code branch that manages an already existing vlan configuration.

CVE-2023-25583 [HIGH] CWE-78 CVE-2023-25583: Two OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR3 Two OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the code branch that manages a new vlan configuration.

CVE-2023-24018 [HIGH] CWE-121 CVE-2023-24018: A stack-based buffer overflow vulnerability exists in the libzebra.so.0.0.0 security_decrypt_passwor A stack-based buffer overflow vulnerability exists in the libzebra.so.0.0.0 security_decrypt_password functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to a buffer overflow. An authenticated attacker can send an HTTP request to trigger this vulnerability.

CVE-2023-24595 [HIGH] CWE-78 CVE-2023-24595: An OS command injection vulnerability exists in the ys_thirdparty system_user_script functionality o An OS command injection vulnerability exists in the ys_thirdparty system_user_script functionality of Milesight UR32L v32.3.0.5. A specially crafted series of network requests can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.

CVE-2023-22659 [HIGH] CWE-77 CVE-2023-22659: An os command injection vulnerability exists in the libzebra.so change_hostname functionality of Mil An os command injection vulnerability exists in the libzebra.so change_hostname functionality of Milesight UR32L v32.3.0.5. A specially-crafted network packets can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.

CVE-2023-23550 [HIGH] CWE-77 CVE-2023-23550: An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Miles An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.

CVE-2023-22306 [HIGH] CWE-77 CVE-2023-22306: An OS command injection vulnerability exists in the libzebra.so bridge_group functionality of Milesi An OS command injection vulnerability exists in the libzebra.so bridge_group functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.

CVE-2023-24019 [HIGH] CWE-120 CVE-2023-24019: A stack-based buffer overflow vulnerability exists in the urvpn_client http_connection_readcb functi A stack-based buffer overflow vulnerability exists in the urvpn_client http_connection_readcb functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to a buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.

CVE-2023-22365 [HIGH] CWE-78 CVE-2023-22365: An OS command injection vulnerability exists in the ys_thirdparty check_system_user functionality of An OS command injection vulnerability exists in the ys_thirdparty check_system_user functionality of Milesight UR32L v32.3.0.5. A specially crafted set of network packets can lead to command execution. An attacker can send a network request to trigger this vulnerability.

CVE-2023-25094 [HIGH] CWE-121 CVE-2023-25094: Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the into_class_n

CVE-2023-25092 [HIGH] CWE-121 CVE-2023-25092: Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the handle_inter

CVE-2023-25104 [HIGH] CWE-121 CVE-2023-25104: Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_ike_prof