CVSS 3.1 Score 7.2 of 10 (high)


Published Jul 6, 2023
Updated: Aug 2, 2023
CWE ID 787
CWE ID 121


CVE-2023-25102 is a high-severity vulnerability that affects the Milesight UR32L v32.3.0.5 product, specifically the vtysh_ubus binary. It is caused by multiple buffer overflow vulnerabilities resulting from the use of an unsafe sprintf pattern. An attacker with high privileges can exploit these vulnerabilities by sending a specially crafted HTTP request, leading to arbitrary code execution. The buffer overflow occurs in the set_dmvpn function with the hub_ip and hub_gre_ip variables. Organizations using this product should remediate the issue by applying the necessary patches or updates provided by Milesight. This vulnerability poses a significant danger to organizations as it allows attackers to execute arbitrary code on vulnerable systems, potentially leading to unauthorized access, data breaches, and further compromise of network security.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-25102 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options