CVE-2023-23550

Name of the Vulnerable Software and Affected Versions Milesight UR32L version 32.3.0.5

Description An OS command injection issue exists in the ys thirdparty user delete functionality. A specially crafted network packet can lead to command execution. An attacker can send a sequence of requests to trigger this issue.

Recommendations For Milesight UR32L version 32.3.0.5, consider disabling the user delete functionality in ys thirdparty until a patch is available to prevent potential command execution. Restrict access to the vulnerable functionality to minimize the risk of exploitation.