CVE-2023-47166 - A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2

Back Back to CVE browser

HIGH

A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2

Published May 1, 2024

8.8

HIGH

CVSS 3.1

EPSS 0.64%

Description

A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2. A specially crafted network request can lead to arbitrary firmware update. An attacker can send a network request to trigger this vulnerability.

Affected products

Vendor Milesight Product UR32L Default
n/a
- Version
  v32.3.0.7-r2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Milesight

UR32L

n/a

Version	Status	Constraints
v32.3.0.7-r2	affected	-

Vendor Milesight Product Ur32l Default
n/a
- Version
  32.3.0.7-r2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Milesight

Ur32l

n/a

Version	Status	Constraints
32.3.0.7-r2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-285

CWE-306

Missing Authentication

References (2)

Link	Providers	Tags
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1852		Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1852