CVE-2023-24519
📋 TL;DR
This CVE describes two OS command injection vulnerabilities in the Milesight UR32L router's vtysh_ubus toolsh_excute functionality. Attackers can execute arbitrary commands on affected devices by sending specially-crafted network requests to the ping utility. This affects Milesight UR32L router users running vulnerable firmware versions.
💻 Affected Systems
- Milesight UR32L
📦 What is this software?
Ur32l Firmware by Milesight
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, pivot to internal networks, intercept traffic, or use the device for botnet activities.
Likely Case
Remote code execution leading to device takeover, credential theft, network reconnaissance, and potential lateral movement within the network.
If Mitigated
Limited impact if devices are behind firewalls with strict network segmentation and access controls.
🎯 Exploit Status
The Talos Intelligence report includes technical details that could be used to create exploits. The vulnerability is in a network-accessible utility function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found at time of analysis
Restart Required: Yes
Instructions:
1. Check Milesight support for firmware updates. 2. If update available, download from official source. 3. Backup configuration. 4. Apply firmware update via web interface. 5. Verify update and restore configuration if needed.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to the UR32L management interface using firewall rules
Disable Unnecessary Services
linuxDisable or restrict access to vtysh_ubus services if not required
🧯 If You Can't Patch
- Segment UR32L devices on isolated network VLANs with strict firewall rules
- Implement network monitoring for unusual ping utility usage or command injection patterns
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (System > Status) or CLI. If version is v32.3.0.5 or earlier, assume vulnerable.Check Version:
ssh admin@router-ip 'cat /etc/version' or check web interface System > StatusVerify Fix Applied:
Verify firmware version has been updated beyond v32.3.0.5 and test ping functionality with controlled inputs.📡 Detection & Monitoring
Log Indicators:
- Unusual ping command patterns in system logs
- Unexpected process execution from vtysh_ubus
- Failed authentication attempts followed by ping utility usage
Network Indicators:
- Unusual network traffic to UR32L management interface
- Ping requests with abnormal parameters or payloads
- Outbound connections from UR32L to unexpected destinations
SIEM Query:
source="ur32l_logs" AND (process="vtysh_ubus" OR command="ping") AND (payload CONTAINS ";" OR payload CONTAINS "|" OR payload CONTAINS "`")