CVE-2023-24583

2023-07-0615:15:12

CWE-77

[email protected]

web.nvd.nist.gov

cve-2023-24583

urvpn_client

command execution

network request

udp packet

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.004

Percentile

74.7%

JSON

Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This OS command injection is triggered through a UDP packet.

Affected configurations

Nvd

Node

milesightur32l_firmwareMatch32.3.0.5

AND

milesightur32lMatch-

VendorProductVersionCPE
milesightur32l_firmware32.3.0.5cpe:2.3:o:milesight:ur32l_firmware:32.3.0.5:*:*:*:*:*:*:*
milesightur32l-cpe:2.3:h:milesight:ur32l:-:*:*:*:*:*:*:*