CVE-2023-24582
📋 TL;DR
Two OS command injection vulnerabilities in Milesight UR32L routers allow remote attackers to execute arbitrary commands via specially crafted TCP packets. This affects UR32L routers running vulnerable firmware, potentially giving attackers full control over affected devices.
💻 Affected Systems
- Milesight UR32L
📦 What is this software?
Ur32l Firmware by Milesight
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install persistent backdoors, pivot to internal networks, intercept traffic, or use device as botnet node.
Likely Case
Remote code execution leading to device takeover, credential theft, network reconnaissance, and lateral movement within the network.
If Mitigated
Limited impact if devices are behind firewalls with strict network segmentation and access controls.
🎯 Exploit Status
Vulnerability details are public but no public exploit code. TCP-based exploitation makes weaponization straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Milesight security advisory for latest patched version
Vendor Advisory: https://www.milesight.com/security/
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Download latest firmware from Milesight support portal. 3. Upload firmware via web interface. 4. Reboot device after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate UR32L devices from untrusted networks using firewall rules
Access Control Lists
linuxRestrict TCP access to device management interfaces to trusted IPs only
iptables -A INPUT -p tcp --dport [UR32L_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [UR32L_PORT] -j DROP
🧯 If You Can't Patch
- Segment UR32L devices in isolated VLAN with strict firewall rules
- Implement network monitoring for suspicious traffic to UR32L management ports
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface at System > Maintenance > FirmwareCheck Version:
Login to web interface and navigate to System > Maintenance > Firmware sectionVerify Fix Applied:
Confirm firmware version is updated beyond v32.3.0.5 and test with vulnerability scanner📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Failed authentication attempts followed by command execution
Network Indicators:
- TCP packets to UR32L management ports containing shell metacharacters
- Unexpected outbound connections from UR32L devices
SIEM Query:
source="ur32l" AND (cmd_name_action OR "urvpn_client") AND (exec OR system OR "$" OR "|")