CVSS 3.1 Score 7.2 of 10 (high)


Published Jul 6, 2023
Updated: Aug 2, 2023
CWE ID 787
CWE ID 121


CVE-2023-25118 is a vulnerability that affects Milesight UR32L v32.3.0.5, specifically the vtysh_ubus binary. The vulnerability is caused by multiple buffer overflow vulnerabilities resulting from the use of an unsafe sprintf pattern. An attacker with high privileges can exploit this vulnerability by sending a specially crafted HTTP request, which can lead to arbitrary code execution. The buffer overflow occurs in the set_openvpn_client function with the username and password variables. This vulnerability has a base severity rating of HIGH, with a base score of 7.2 according to the CVSS:3.1 vector string. It poses a potential danger to organizations as it allows for unauthorized code execution and can compromise the confidentiality, integrity, and availability of affected systems. To remediate this vulnerability, users should update their Milesight UR32L devices to a version that addresses this issue when available.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-25118 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options