Misconfiguration Vulnerability in Milesight UR32L Product
CVE-2023-23546

4.2MEDIUM

Key Information:

Vendor

Milesight

Status
Ur32l
Vendor
CVE Published:
6 July 2023

What is CVE-2023-23546?

A misconfiguration in the urvpn_client functionality of Milesight UR32L version 32.3.0.5 allows for potential privilege escalation through a man-in-the-middle attack. Malicious actors can exploit this vulnerability by intercepting communications, leading to unauthorized access and control over the affected device. This highlights the importance of secure configurations and regular updates to mitigate such security risks.

Affected Version(s)

UR32L v32.3.0.5

References

https://talosintelligence.com/vulnerability_reports/TALOS...

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by Francesco Benvenuto of Cisco Talos.
.