CVE-2023-25124: Buffer Overflow
Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the setopenvpnclient function with the remotesubnet and the remotemask variables.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2023-25124.
What is the severity level of CVE-2023-25124?
The severity level of CVE-2023-25124 is high.
What is the affected software of CVE-2023-25124?
The affected software of CVE-2023-25124 is Milesight UR32L v32.3.0.5.
How can an attacker exploit CVE-2023-25124?
An attacker can exploit CVE-2023-25124 by sending a specially crafted HTTP request, which can lead to arbitrary code execution.
Is there a fix available for CVE-2023-25124?
There is no information provided about an available fix for CVE-2023-25124. It is recommended to contact the vendor for further assistance.