CVE-2023-22365: OS Command Injection
Published Jul 6, 2023
·Updated
An OS command injection vulnerability exists in the ysthirdparty checksystemuser functionality of Milesight UR32L v32.3.0.5. A specially crafted set of network packets can lead to command execution. An attacker can send a network request to trigger this vulnerability.
Affected Software
2 affected components
Milesight Ur32l Firmware=32.3.0.5
Milesight UR32L
Event History
Jul 6, 2023
CVE Published
via MITRE·02:53 PM
Data Sourced
via MITRE·02:53 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this OS command injection vulnerability?
The vulnerability ID for this OS command injection vulnerability is CVE-2023-22365.
2
What is the affected software?
The affected software is Milesight UR32L v32.3.0.5 firmware.
3
How does the vulnerability occur?
The vulnerability occurs in the ys_thirdparty check_system_user functionality of Milesight UR32L v32.3.0.5.
4
What is the severity rating of this vulnerability?
The severity rating of this vulnerability is high, with a CVSS score of 7.2.
5
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by sending a specially crafted set of network packets, which can lead to command execution.