Lucene search

PRIOn knowledge basePRION:CVE-2023-25113

HistoryJul 06, 2023 - 3:15 p.m.

Buffer overflow

2023-07-0615:15:00

PRIOn knowledge base

www.prio-n.com

buffer overflow

vtysh_ubus

milesight ur32l

sprintf pattern

http request

code execution

high privileges

set_l2tp function

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.8%

JSON

Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_l2tp function with the key variable.

CPENameOperatorVersion
ur32l_firmwareeq32.3.0.5

CPE	Name	Operator	Version
	ur32l_firmware	eq	32.3.0.5

References

talosintelligence.com/vulnerability_reports/TALOS-2023-1716