CVE-2023-25115: Buffer Overflow
Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the setopenvpnclient function with the remoteip and the port variables.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-25115?
CVE-2023-25115 is a vulnerability that exists in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 firmware due to multiple buffer overflow vulnerabilities.
How can CVE-2023-25115 be exploited?
CVE-2023-25115 can be exploited by sending a specially crafted HTTP request, which can lead to arbitrary code execution.
What is the severity of CVE-2023-25115?
CVE-2023-25115 has a severity rating of 7.2 (high).
What software versions are affected by CVE-2023-25115?
CVE-2023-25115 affects Milesight UR32L v32.3.0.5 firmware.
Is Milesight UR32L vulnerable to CVE-2023-25115?
No, Milesight UR32L itself is not vulnerable to CVE-2023-25115.