CVE-2023-22299: OS Command Injection
Published Jul 6, 2023
·Updated
An OS command injection vulnerability exists in the vtyshubus getfwlogs functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability.
Affected Software
2 affected components
Milesight Ur32l Firmware=32.3.0.5
Milesight UR32L
Event History
Jul 6, 2023
CVE Published
via MITRE·02:53 PM
Data Sourced
via MITRE·02:53 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-22299?
CVE-2023-22299 is considered a critical vulnerability due to its potential to allow OS command injection and remote code execution.
2
How do I fix CVE-2023-22299?
To fix CVE-2023-22299, upgrade the Milesight UR32L firmware to version 32.3.0.6 or later.
3
What type of vulnerability is CVE-2023-22299?
CVE-2023-22299 is classified as an OS command injection vulnerability.
4
Who is affected by CVE-2023-22299?
CVE-2023-22299 affects users of Milesight UR32L firmware version 32.3.0.5.
5
What can an attacker do with CVE-2023-22299?
An attacker can exploit CVE-2023-22299 to execute arbitrary commands on the device by sending a specially crafted network request.