CVE-2023-25120
📋 TL;DR
This vulnerability allows authenticated attackers with high privileges to execute arbitrary code on Milesight UR32L routers by sending specially crafted HTTP requests. The buffer overflow occurs in the vtysh_ubus binary's set_dmvpn function when handling the cisco_secret variable. Only users of Milesight UR32L routers running vulnerable firmware are affected.
💻 Affected Systems
- Milesight UR32L
📦 What is this software?
Ur32l Firmware by Milesight
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to install persistent backdoors, pivot to internal networks, or disrupt network operations.
Likely Case
Attacker gains root access to the router, enabling traffic interception, credential theft, and lateral movement within the network.
If Mitigated
Limited impact if proper network segmentation and privilege separation are implemented, though router integrity may still be compromised.
🎯 Exploit Status
Exploitation requires authenticated access with high privileges and knowledge of the vulnerable HTTP endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Milesight website for security advisories
2. Download latest firmware if available
3. Backup configuration
4. Upload and install new firmware
5. Verify installation and restore configuration if needed
🔧 Temporary Workarounds
Restrict HTTP Access
linuxLimit HTTP access to the router's management interface to trusted IP addresses only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disable Unnecessary Services
linuxDisable the vtysh_ubus service if not required for network operations
systemctl stop vtysh_ubus
systemctl disable vtysh_ubus
🧯 If You Can't Patch
- Implement strict network segmentation to isolate UR32L routers from critical systems
- Enforce principle of least privilege for all administrative accounts and monitor for suspicious HTTP requests
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or SSH: cat /etc/version | grep 32.3.0.5Check Version:
cat /etc/versionVerify Fix Applied:
Verify firmware version is updated beyond v32.3.0.5 and test HTTP requests to vulnerable endpoints return errors📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to router management interface
- Multiple failed authentication attempts followed by successful admin login
- Process crashes of vtysh_ubus binary
Network Indicators:
- HTTP traffic to router on non-standard ports
- Unusual outbound connections from router after HTTP requests
SIEM Query:
source="router_logs" AND (http_method="POST" AND uri CONTAINS "dmvpn" OR process="vtysh_ubus" AND event="crash")