CVE-2023-25121: Buffer Overflow
Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the setikeprofile function with the secretslocal variable.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-25121?
CVE-2023-25121 is a vulnerability in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 that allows for arbitrary code execution through specially crafted HTTP requests.
What is the severity of CVE-2023-25121?
CVE-2023-25121 has a severity rating of 7.2 (High).
How does CVE-2023-25121 affect Milesight Ur32l Firmware?
CVE-2023-25121 affects Milesight Ur32l Firmware version 32.3.0.5.
How do I fix CVE-2023-25121?
To fix CVE-2023-25121, it is recommended to update Milesight Ur32l Firmware to a version that addresses the vulnerability.
Where can I find more information about CVE-2023-25121?
More information about CVE-2023-25121 can be found at the following link: [CVE-2023-25121](https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716).