CVE-2023-43261

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-43261
An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://milesight.com Product
http://packetstormsecurity.com/files/176988/Milesight-UR5X-UR32L-UR32-UR35-UR41-Credential-Leakage.html
http://ur5x.com Broken Link Not Applicable
https://github.com/win3zz/CVE-2023-43261 Exploit Third Party Advisory
https://medium.com/%40win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
https://support.milesight-iot.com/support/home Product
http://milesight.com Product
http://packetstormsecurity.com/files/176988/Milesight-UR5X-UR32L-UR32-UR35-UR41-Credential-Leakage.html
http://ur5x.com Broken Link Not Applicable
https://github.com/win3zz/CVE-2023-43261 Exploit Third Party Advisory
https://medium.com/%40win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
https://support.milesight-iot.com/support/home Product
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:milesight:ur5x_firmware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:milesight:ur51:-:*:*:*:*:*:*:*
cpe:2.3:h:milesight:ur52:-:*:*:*:*:*:*:*
cpe:2.3:h:milesight:ur55:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:milesight:ur32l_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:milesight:ur32l:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:milesight:ur32_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:milesight:ur32:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:milesight:ur35_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:milesight:ur35:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:milesight:ur41_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:milesight:ur41:-:*:*:*:*:*:*:*
History

21 Nov 2024, 08:23

Type Values Removed Values Added
References () http://milesight.com - Product () http://milesight.com - Product
References () http://packetstormsecurity.com/files/176988/Milesight-UR5X-UR32L-UR32-UR35-UR41-Credential-Leakage.html - () http://packetstormsecurity.com/files/176988/Milesight-UR5X-UR32L-UR32-UR35-UR41-Credential-Leakage.html -
References () http://ur5x.com - Broken Link, Not Applicable () http://ur5x.com - Broken Link, Not Applicable
References () https://github.com/win3zz/CVE-2023-43261 - Exploit, Third Party Advisory () https://github.com/win3zz/CVE-2023-43261 - Exploit, Third Party Advisory
References () https://medium.com/%40win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf - () https://medium.com/%40win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf -
References () https://support.milesight-iot.com/support/home - Product () https://support.milesight-iot.com/support/home - Product

05 Feb 2024, 17:15

Type Values Removed Values Added
References
  • () http://packetstormsecurity.com/files/176988/Milesight-UR5X-UR32L-UR32-UR35-UR41-Credential-Leakage.html -

07 Nov 2023, 04:21

Type Values Removed Values Added
References
  • {'url': 'https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf', 'name': 'https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf', 'tags': ['Exploit'], 'refsource': 'MISC'}
  • () https://medium.com/%40win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf -

11 Oct 2023, 17:39

Type Values Removed Values Added
References (MISC) https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf - (MISC) https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf - Exploit
References (MISC) http://ur5x.com - (MISC) http://ur5x.com - Broken Link, Not Applicable
References (MISC) https://support.milesight-iot.com/support/home - (MISC) https://support.milesight-iot.com/support/home - Product
References (MISC) http://milesight.com - (MISC) http://milesight.com - Product
References (MISC) https://github.com/win3zz/CVE-2023-43261 - (MISC) https://github.com/win3zz/CVE-2023-43261 - Exploit, Third Party Advisory
CWE CWE-532
First Time Milesight ur35 Firmware
Milesight ur32l Firmware
Milesight ur41 Firmware
Milesight ur5x Firmware
Milesight ur32l
Milesight
Milesight ur32
Milesight ur55
Milesight ur32 Firmware
Milesight ur52
Milesight ur51
Milesight ur35
Milesight ur41
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CPE cpe:2.3:h:milesight:ur52:-:*:*:*:*:*:*:*
cpe:2.3:h:milesight:ur32l:-:*:*:*:*:*:*:*
cpe:2.3:h:milesight:ur55:-:*:*:*:*:*:*:*
cpe:2.3:h:milesight:ur32:-:*:*:*:*:*:*:*
cpe:2.3:o:milesight:ur41_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:milesight:ur35:-:*:*:*:*:*:*:*
cpe:2.3:o:milesight:ur32_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:milesight:ur41:-:*:*:*:*:*:*:*
cpe:2.3:h:milesight:ur51:-:*:*:*:*:*:*:*
cpe:2.3:o:milesight:ur32l_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:milesight:ur5x_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:milesight:ur35_firmware:*:*:*:*:*:*:*:*

04 Oct 2023, 12:56

Type Values Removed Values Added
New CVE
Information

Published : 2023-10-04 12:15

Updated : 2024-11-21 08:23

NVD link : CVE-2023-43261

Mitre link : CVE-2023-43261

CVE.ORG link : CVE-2023-43261

JSON object : View

Products Affected

milesight

  • ur41_firmware
  • ur32l_firmware
  • ur5x_firmware
  • ur32l
  • ur55
  • ur32_firmware
  • ur52
  • ur32
  • ur41
  • ur51
  • ur35
  • ur35_firmware
CWE
CWE-532

Insertion of Sensitive Information into Log File