CVE-2023-23550 - OpenCVE

An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Milesight	Ur32l Ur32l Firmware

Configuration 1 [-]

AND

cpe:2.3:o:milesight:ur32l_firmware:32.3.0.5:*:*:*:*:*:*:*

cpe:2.3:h:milesight:ur32l:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1694
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1694

History

No history.

MITRE

Status: PUBLISHED

Assigner: talos

Published: 2023-07-06T14:53:35.622Z

Updated: 2024-08-02T10:35:32.712Z

Reserved: 2023-01-19T14:56:01.395Z

Link: CVE-2023-23550

Vulnrichment

Updated: 2024-08-02T10:35:32.712Z

NVD

Status : Analyzed

Published: 2023-07-06T15:15:11.497

Modified: 2023-07-13T17:20:58.420

Link: CVE-2023-23550

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-23550", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "state": "PUBLISHED", "assignerShortName": "talos", "dateReserved": "2023-01-19T14:56:01.395Z", "datePublished": "2023-07-06T14:53:35.622Z", "dateUpdated": "2024-08-02T10:35:32.712Z"}, "containers": {"cna": {"affected": [{"vendor": "Milesight", "product": "UR32L", "versions": [{"version": "v32.3.0.5", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "type": "CWE", "cweId": "CWE-77"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2023-07-06T17:00:09.199Z"}, "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1694", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1694"}], "credits": [{"lang": "en", "value": "Discovered by Francesco Benvenuto of Cisco Talos."}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1694"}, {"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1694", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1694", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:35:32.712Z"}}, {"affected": [{"vendor": "milesight", "product": "ur32l_firmware", "cpes": ["cpe:2.3:o:milesight:ur32l_firmware:32.3.0.5:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "32.3.0.5", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-31T20:34:39.502209Z", "id": "CVE-2023-23550", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-31T20:41:12.776Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1694"}, {"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1694", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1694", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:35:32.712Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-23550", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-07-31T20:34:39.502209Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:milesight:ur32l_firmware:32.3.0.5:*:*:*:*:*:*:*"], "vendor": "milesight", "product": "ur32l_firmware", "versions": [{"status": "affected", "version": "32.3.0.5"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-31T20:41:07.602Z"}}], "cna": {"credits": [{"lang": "en", "value": "Discovered by Francesco Benvenuto of Cisco Talos."}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Milesight", "product": "UR32L", "versions": [{"status": "affected", "version": "v32.3.0.5"}]}], "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1694", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1694"}], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2023-07-06T17:00:09.199Z"}}}, "cveMetadata": {"cveId": "CVE-2023-23550", "state": "PUBLISHED", "dateUpdated": "2024-08-02T10:35:32.712Z", "dateReserved": "2023-01-19T14:56:01.395Z", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "datePublished": "2023-07-06T14:53:35.622Z", "assignerShortName": "talos"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:milesight:ur32l_firmware:32.3.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "CF5F2502-0C97-4AC3-BD0A-45065C64F99B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:milesight:ur32l:-:*:*:*:*:*:*:*", "matchCriteriaId": "224B5936-7A7A-48E7-B0F3-754B74E4BF2D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability."}], "id": "CVE-2023-23550", "lastModified": "2023-07-13T17:20:58.420", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "talos-cna@cisco.com", "type": "Secondary"}]}, "published": "2023-07-06T15:15:11.497", "references": [{"source": "talos-cna@cisco.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1694"}], "sourceIdentifier": "talos-cna@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-77"}], "source": "talos-cna@cisco.com", "type": "Secondary"}]}