Vulnerability · Published Jul 6, 2023 · Assigned by talos
CVE-2023-22653
High 8.8
In plain English
A high-severity OS command injection in UR32L from Milesight. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.8% (higher than 93% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)5.8%top 6.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An OS command injection vulnerability exists in the vtysh_ubus tcpdump_start_cb functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to command execution. An authenticated attacker can send an HTTP request to trigger this vulnerability.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H