PT-2023-19668 · Milesight · Milesight Ur32L

Francesco Benvenuto

·

CVE-2023-24520

·

Publicado

2023-07-06

·

Atualizado

2023-07-13

CVSS v3.1

8.8

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Milesight UR32L version 32.3.0.5
Description A command injection issue exists in the vtysh ubus toolsh excute.constprop.1 functionality. This allows an attacker to execute commands by sending a specially-crafted network request to the trace tool utility.
Recommendations For Milesight UR32L version 32.3.0.5, consider disabling the vtysh ubus toolsh excute.constprop.1 functionality until a patch is available to prevent command execution. Restrict access to the trace tool utility to minimize the risk of exploitation.

Exploit

Correção

OS Command Injection

Command Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-78CWE-77

Identificadores relacionados

CVE-2023-24520

Produtos afetados

Milesight Ur32L