CVE-2023-25110
📋 TL;DR
This vulnerability allows authenticated attackers with high privileges to execute arbitrary code on Milesight UR32L routers by sending specially crafted HTTP requests. The buffer overflow occurs in the vtysh_ubus binary's set_gre function due to unsafe sprintf usage. Only UR32L routers running vulnerable firmware versions are affected.
💻 Affected Systems
- Milesight UR32L
📦 What is this software?
Ur32l Firmware by Milesight
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to install persistent backdoors, pivot to internal networks, or disrupt network operations.
Likely Case
Privilege escalation leading to unauthorized configuration changes, network traffic interception, or denial of service.
If Mitigated
Limited impact if proper network segmentation and privilege controls prevent high-privilege access to vulnerable interfaces.
🎯 Exploit Status
Exploitation requires high-privilege credentials and knowledge of the vulnerable HTTP endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Check Milesight security advisories for patch availability. 2. Download latest firmware from vendor portal. 3. Upload firmware via web interface. 4. Apply and reboot device.
🔧 Temporary Workarounds
Restrict HTTP Interface Access
linuxLimit access to the router's HTTP management interface to trusted networks only.
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disable Unused Features
allDisable GRE tunneling features if not required for network operations.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate UR32L routers from untrusted networks
- Enforce principle of least privilege for administrative accounts and monitor for suspicious HTTP requests
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or CLI. If version is v32.3.0.5 or earlier, device is likely vulnerable.Check Version:
cat /etc/version or check web interface System Information pageVerify Fix Applied:
Verify firmware version has been updated to a version later than v32.3.0.5.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to vtysh_ubus endpoints
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- HTTP traffic to router management interface containing GRE configuration parameters
- Unusual outbound connections from router after HTTP requests
SIEM Query:
source="router_logs" AND (uri="*vtysh_ubus*" OR method="POST") AND (user="admin" OR user="root")