CVE-2023-24520

Summary

Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the trace tool utility.

Affected Software

Weaknesses

• CWE-77: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

ADP Enrichment

CVE Program Container

Additional References

• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1706
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1706

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

References

• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1706

• ←Previous
• Next→