ID
VAR-202307-0136
CVE
CVE-2023-25118
TITLE
Milesight Technology of ur32l Out-of-bounds write vulnerability in firmware
Trust: 0.8
DESCRIPTION
Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_openvpn_client function with the username and the password variables. Milesight Technology of ur32l An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Milesight UR32L is a 4G industrial router produced by China Milesight. There is a buffer overflow vulnerability in the Milesight UR32L set_openvpn_client function, which can be exploited by an attacker to overflow the buffer and execute arbitrary code on the system, or cause the application to crash
Trust: 2.25
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | milesight | model: | ur32l | scope: | eq | version: | 32.3.0.5 | Trust: 1.0 |
| vendor: | milesight | model: | ur32l | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | milesight | model: | ur32l | scope: | eq | version: | ur32l firmware 32.3.0.5 | Trust: 0.8 |
| vendor: | milesight | model: | ur32l | scope: | - | version: | - | Trust: 0.8 |
| vendor: | milesight | model: | ur32l | scope: | eq | version: | v32.3.0.5 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-121 | Trust: 1.0 |
| problemtype: | CWE-787 | Trust: 1.0 |
| problemtype: | Out-of-bounds writing (CWE-787) [NVD evaluation ] | Trust: 0.8 |
THREAT TYPE
remote
Trust: 0.6
TYPE
other
Trust: 0.6
EXTERNAL IDS
| db: | NVD | id: | CVE-2023-25118 | Trust: 3.9 |
| db: | TALOS | id: | TALOS-2023-1716 | Trust: 2.5 |
| db: | JVNDB | id: | JVNDB-2023-017222 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2023-65079 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202307-346 | Trust: 0.6 |
| db: | VULMON | id: | CVE-2023-25118 | Trust: 0.1 |
REFERENCES
| url: | https://talosintelligence.com/vulnerability_reports/talos-2023-1716 | Trust: 3.1 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2023-25118 | Trust: 1.4 |
| url: | https://www.talosintelligence.com/vulnerability_reports/talos-2023-1716 | Trust: 1.0 |
| url: | https://cxsecurity.com/cveshow/cve-2023-25118/ | Trust: 0.6 |
| url: | https://cwe.mitre.org/data/definitions/121.html | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
CREDITS
Discovered by Francesco Benvenuto of Cisco Talos.
Trust: 0.6
SOURCES
| db: | CNVD | id: | CNVD-2023-65079 |
| db: | VULMON | id: | CVE-2023-25118 |
| db: | CNNVD | id: | CNNVD-202307-346 |
| db: | JVNDB | id: | JVNDB-2023-017222 |
| db: | NVD | id: | CVE-2023-25118 |
LAST UPDATE DATE
2025-11-18T15:06:03.338000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2023-65079 | date: | 2023-08-25T00:00:00 |
| db: | VULMON | id: | CVE-2023-25118 | date: | 2023-07-06T00:00:00 |
| db: | CNNVD | id: | CNNVD-202307-346 | date: | 2023-07-18T00:00:00 |
| db: | JVNDB | id: | JVNDB-2023-017222 | date: | 2024-01-05T08:13:00 |
| db: | NVD | id: | CVE-2023-25118 | date: | 2025-11-04T20:16:23.553 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2023-65079 | date: | 2023-08-25T00:00:00 |
| db: | VULMON | id: | CVE-2023-25118 | date: | 2023-07-06T00:00:00 |
| db: | CNNVD | id: | CNNVD-202307-346 | date: | 2023-07-06T00:00:00 |
| db: | JVNDB | id: | JVNDB-2023-017222 | date: | 2024-01-05T00:00:00 |
| db: | NVD | id: | CVE-2023-25118 | date: | 2023-07-06T15:15:15.097 |