CVE-2023-43261 : An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.

An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components.

Published 2023-10-04 12:15:11

Updated 2024-02-05 17:15:09

Source MITRE

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2023-43261

Milesight » Ur32l Firmware
Versions before (<) 35.3.0.7
cpe:2.3:o:milesight:ur32l_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Milesight » Ur32l » Version: N/A
Milesight » Ur5x Firmware
Versions before (<) 35.3.0.7
cpe:2.3:o:milesight:ur5x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Milesight » Ur51 » Version: N/A
When used together with: Milesight » Ur52 » Version: N/A
When used together with: Milesight » Ur55 » Version: N/A
Milesight » Ur32 Firmware
Versions before (<) 35.3.0.7
cpe:2.3:o:milesight:ur32_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Milesight » Ur32 » Version: N/A
Milesight » Ur35 Firmware
Versions before (<) 35.3.0.7
cpe:2.3:o:milesight:ur35_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Milesight » Ur35 » Version: N/A
Milesight » Ur41 Firmware
Versions before (<) 35.3.0.7
cpe:2.3:o:milesight:ur41_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Milesight » Ur41 » Version: N/A

EPSS FAQ

1.99%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 89 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.

Assigned by: nvd@nist.gov (Primary)

https://github.com/win3zz/CVE-2023-43261

GitHub - win3zz/CVE-2023-43261: CVE-2023-43261 - Credential Leakage Through Unprotected System Logs and Weak Password Encryption
Exploit;Third Party Advisory
https://medium.com/%40win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf

Inside the Router: How I Accessed Industrial Routers and Reported the Flaws | by Bipin Jitiya | Medium
http://milesight.com

Milesight | 5G, AI, IoT and LoRaWAN
Product
https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf

Inside the Router: How I Accessed Industrial Routers and Reported the Flaws | by Bipin Jitiya | Oct, 2023 | Medium
Exploit
https://support.milesight-iot.com/support/home

Support : IoT Support
Product
http://packetstormsecurity.com/files/176988/Milesight-UR5X-UR32L-UR32-UR35-UR41-Credential-Leakage.html

Milesight UR5X / UR32L / UR32 / UR35 / UR41 Credential Leakage ≈ Packet Storm
http://ur5x.com

Broken Link;Not Applicable

Jump to