CVE-2023-25096
📋 TL;DR
This vulnerability allows authenticated attackers with high privileges to execute arbitrary code on Milesight UR32L routers by sending specially crafted HTTP requests that trigger buffer overflows in the vtysh_ubus binary. The vulnerability affects UR32L routers running vulnerable firmware versions due to unsafe sprintf usage in the set_qos function.
💻 Affected Systems
- Milesight UR32L
📦 What is this software?
Ur32l Firmware by Milesight
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root-level code execution, enabling persistent backdoor installation, network pivoting, and data exfiltration.
Likely Case
Privileged attacker gains remote code execution to modify router configuration, intercept traffic, or disrupt network services.
If Mitigated
Attack limited to authenticated high-privilege users only, with network segmentation preventing lateral movement.
🎯 Exploit Status
Exploitation requires authentication with high privileges and knowledge of the vulnerable HTTP endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check vendor website for firmware updates. 2. Download latest firmware. 3. Upload via web interface. 4. Apply update and reboot router.
🔧 Temporary Workarounds
Restrict HTTP Access
linuxLimit access to router's HTTP management interface to trusted networks only.
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disable Unused QoS Features
allDisable Quality of Service features if not required to reduce attack surface.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate UR32L routers from critical systems
- Enforce principle of least privilege for router administrative accounts and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or SSH: cat /etc/version | grep 32.3.0.5Check Version:
cat /etc/versionVerify Fix Applied:
Verify firmware version is updated beyond v32.3.0.5 and test QoS functionality📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to QoS-related endpoints
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- HTTP POST requests with unusually long rule_name parameters
- Traffic patterns suggesting buffer overflow attempts
SIEM Query:
source="router.log" AND (http_uri="*qos*" OR http_uri="*set_qos*") AND http_method="POST" AND http_param_length>100