CVE-2023-47166
📋 TL;DR
This vulnerability allows attackers to upload arbitrary firmware to Milesight UR32L routers through the luci2-io file-import functionality. Attackers can send specially crafted network requests to install malicious firmware, potentially gaining complete control of affected devices. This affects Milesight UR32L routers running vulnerable firmware versions.
💻 Affected Systems
- Milesight UR32L
📦 What is this software?
Ur32l Firmware by Milesight
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent backdoor installation, credential theft, network pivoting, and use as botnet nodes.
Likely Case
Unauthorized firmware installation leading to device takeover, network monitoring, and credential harvesting.
If Mitigated
Limited impact if devices are behind firewalls with strict network segmentation and access controls.
🎯 Exploit Status
The vulnerability requires network access but no authentication, making exploitation straightforward for attackers with network connectivity to the device.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found at time of analysis
Restart Required: Yes
Instructions:
1. Check Milesight support for firmware updates. 2. Download latest firmware if available. 3. Upload via web interface. 4. Reboot device to apply.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to UR32L management interface using firewall rules.
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Web Interface
linuxTemporarily disable the web management interface if not needed.
service luci2-io stop
chkconfig luci2-io off
🧯 If You Can't Patch
- Isolate affected devices in separate VLAN with strict firewall rules
- Implement network monitoring for suspicious firmware upload attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or SSH: cat /etc/versionCheck Version:
cat /etc/version || grep -i version /etc/os-releaseVerify Fix Applied:
Verify firmware version is updated beyond v32.3.0.7-r2📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to luci2-io endpoint
- Firmware update logs from unexpected sources
- Authentication bypass attempts
Network Indicators:
- HTTP POST requests to /cgi-bin/luci2-io/file-import
- Unusual firmware upload traffic patterns
- Network connections to device from unexpected IPs
SIEM Query:
source="ur32l" AND (uri_path="/cgi-bin/luci2-io/file-import" OR event="firmware_update")