CVE-2023-25086: Buffer Overflow
Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the firewallhandlerset function with the index and dport variables.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-25086?
CVE-2023-25086 is a vulnerability that exists in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 firmware, allowing for arbitrary code execution via specially crafted HTTP requests.
What is the severity of CVE-2023-25086?
CVE-2023-25086 has a severity rating of 7.2, which is considered high.
How does CVE-2023-25086 affect Milesight UR32L?
CVE-2023-25086 affects Milesight UR32L v32.3.0.5 firmware, allowing for arbitrary code execution via specially crafted HTTP requests.
How can I fix CVE-2023-25086?
To fix CVE-2023-25086, it is recommended to update Milesight UR32L firmware to a version that addresses the vulnerability.
Where can I find more information about CVE-2023-25086?
You can find more information about CVE-2023-25086 at the following link: [https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716](https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716)