CVE-2023-25106

Summary

CVE-2023-25106 is a buffer overflow vulnerability affecting the vtysh_ubus binary of Milesight UR32L v32.3.0.5. The issue stems from the use of an unsafe sprintf pattern, allowing an attacker to send a specially crafted HTTP request and trigger arbitrary code execution. This vulnerability is located in the set_gre function, specifically with the local_virtual_ip and local_virtual_mask variables. A successful exploit requires high privileges, posing a significant threat to vulnerable systems.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.