Vulnerability · Published Oct 4, 2023 · Assigned by mitre
CVE-2023-43261
High 7.5
In plain English
A high-severity sensitive data in logs in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 63.0% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)63.0%top 0.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling2Nuclei, Public PoC
Official description
An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components.
Affected products (as reported)
Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://support.milesight-iot.com/support/home
- https://github.com/win3zz/CVE-2023-43261
- https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
- http://packetstormsecurity.com/files/176988/Milesight-UR5X-UR32L-UR32-UR35-UR41-Credential-Leakage.html
- https://medium.com/%40win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf x_transferred