CVE-2023-25103: Buffer Overflow
Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the setdmvpn function with the greip and the gremask variables.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-25103?
CVE-2023-25103 is a vulnerability that exists in the vtysh_ubus binary of Milesight UR32L v32.3.0.5.
How severe is CVE-2023-25103?
CVE-2023-25103 has a severity score of 7.2 (high).
What is the affected software?
The affected software is Milesight UR32L v32.3.0.5.
How can CVE-2023-25103 be exploited?
CVE-2023-25103 can be exploited by sending a specially crafted HTTP request, which can lead to arbitrary code execution.
Is Milesight UR32L v32.3.0.5 vulnerable?
Yes, Milesight UR32L v32.3.0.5 is vulnerable to CVE-2023-25103.