CVE-2023-25583: OS Command Injection

Published Jul 6, 2023

Updated

Two OS command injection vulnerabilities exist in the zebra vlanname functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the code branch that manages a new vlan configuration.

Affected Software

4 affected components

Milesight Ur32l Firmware=32.3.0.5

Milesight UR32L

All of the following

Milesight Ur32l Firmware=32.3.0.5

Milesight UR32L

Event History

Jul 6, 2023

CVE Published

via MITRE·02:53 PM

Data Sourced

via MITRE·02:53 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID for the two OS command injection vulnerabilities?

The vulnerability ID for the two OS command injection vulnerabilities is CVE-2023-25583.

What is the affected software for the two OS command injection vulnerabilities?

The affected software for the two OS command injection vulnerabilities is Milesight UR32L v32.3.0.5.

What is the severity of CVE-2023-25583?

The severity of CVE-2023-25583 is high (CVSS score: 7.2).

How can these vulnerabilities be exploited?

These vulnerabilities can be exploited by sending a specially crafted network request to the zebra vlan_name functionality.

What is the recommended fix for CVE-2023-25583?

To fix CVE-2023-25583, it is recommended to update Milesight UR32L firmware to version 32.3.0.6 or later.