CVE-2023-22299
📋 TL;DR
This CVE describes an OS command injection vulnerability in the Milesight UR32L router's vtysh_ubus _get_fw_logs functionality. Attackers can execute arbitrary commands by sending specially crafted network requests, potentially gaining full control of affected devices. Organizations using Milesight UR32L routers with vulnerable firmware are at risk.
💻 Affected Systems
- Milesight UR32L
📦 What is this software?
Ur32l Firmware by Milesight
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to install persistent backdoors, pivot to internal networks, exfiltrate data, or use device as botnet node
Likely Case
Unauthorized command execution leading to device configuration changes, network disruption, or credential harvesting
If Mitigated
Limited impact if network segmentation, strict firewall rules, and access controls prevent exploitation attempts
🎯 Exploit Status
Exploitation requires network access to the device but no authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor for latest firmware
Vendor Advisory: https://www.milesight.com/support/security-advisory/
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Download latest firmware from Milesight support portal. 3. Upload firmware via web interface. 4. Apply update and restart device.
🔧 Temporary Workarounds
Network Segmentation
allIsolate UR32L devices from untrusted networks and restrict access to management interfaces
Firewall Rules
linuxBlock external access to vulnerable service ports
iptables -A INPUT -p tcp --dport [management_port] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the device
- Monitor for unusual network traffic patterns or command execution attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or SSH: cat /etc/versionCheck Version:
cat /etc/versionVerify Fix Applied:
Verify firmware version is updated beyond v32.3.0.5📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Multiple failed authentication attempts followed by successful access
Network Indicators:
- Unexpected outbound connections from UR32L
- Traffic to unusual ports from device
SIEM Query:
source="ur32l_logs" AND (command="*;*" OR command="*|*" OR command="*`*" OR command="*$(*")