Skip to content
OpenAdvisories
High · 7.2 CVE-2023-23550 EUVD-2023-27650GHSA-h73j-p2wc-4gwg

An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5. A specially craft…

Published Jul 6, 2023 · Updated Aug 2, 2024 · Assigned by talos

Vendor: Milesight Product: UR32L

Description

An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.

Affected products

VendorProductAffectedFixed
Milesight UR32L v32.3.0.5 —

References