CVE-2023-24595
📋 TL;DR
This CVE describes an OS command injection vulnerability in the ys_thirdparty system_user_script functionality of Milesight UR32L routers. Attackers can execute arbitrary commands on affected devices by sending specially crafted network requests. Organizations using Milesight UR32L routers with vulnerable firmware are affected.
💻 Affected Systems
- Milesight UR32L
📦 What is this software?
Ur32l Firmware by Milesight
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router leading to network pivoting, data exfiltration, and persistent backdoor installation.
Likely Case
Unauthorized command execution allowing attackers to modify configurations, intercept traffic, or disrupt network services.
If Mitigated
Limited impact if network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
The Talos Intelligence report includes technical details that could facilitate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with Milesight for updated firmware
Vendor Advisory: https://www.milesight.com/support/
Restart Required: Yes
Instructions:
1. Check Milesight support portal for firmware updates. 2. Download the latest firmware. 3. Upload and apply the firmware through the web interface. 4. Reboot the device.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to the UR32L management interface to trusted IPs only.
Configure firewall rules to limit access to UR32L management ports (typically 80/443)
Disable Unnecessary Features
allDisable the ys_thirdparty system_user_script functionality if not required.
Check Milesight documentation for disabling specific features
🧯 If You Can't Patch
- Isolate affected devices in a separate VLAN with strict network segmentation
- Implement network monitoring and intrusion detection for suspicious traffic to UR32L devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version in UR32L web interface under System > FirmwareCheck Version:
Check via web interface or SSH if enabled: cat /etc/versionVerify Fix Applied:
Verify firmware version is updated beyond v32.3.0.5📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Multiple failed authentication attempts followed by successful access
Network Indicators:
- Unusual outbound connections from UR32L
- Suspicious HTTP requests to ys_thirdparty endpoints
SIEM Query:
source="UR32L" AND (url="*ys_thirdparty*" OR command="*system_user_script*")