Aggregates CVE and security vulnerability intelligence across all Milesight-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk path handling and vendor risk cross-site scripting and related security problems, affecting vendor surface production workloads and vendor surface software deployment scenarios.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2025-4043 | An admin user can gain unauthorized write access to the /etc/rc.local file on the device, which is executed on a system boot. | [email protected] | 6.1 | 0.28% | 2025-05-07 | 2026-06-17 |
| CVE-2024-36392 | MileSight DeviceHub - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] | 6.1 | 0.27% | 2024-06-02 | 2026-06-17 |
| CVE-2024-36391 | MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic | [email protected] | 9.1 | 0.35% | 2024-06-02 | 2026-06-17 |
| CVE-2024-36390 | MileSight DeviceHub - CWE-20 Improper Input Validation may allow Denial of Service | [email protected] | 7.5 | 0.42% | 2024-06-02 | 2026-06-17 |
| CVE-2024-36389 | MileSight DeviceHub - CWE-330 Use of Insufficiently Random Values may allow Authentication Bypass | [email protected] | 9.8 | 0.52% | 2024-06-02 | 2026-06-17 |
| CVE-2024-36388 | MileSight DeviceHub - CWE-305 Missing Authentication for Critical Function | [email protected] | 10.0 | 0.47% | 2024-06-02 | 2026-06-17 |
| CVE-2024-27776 | MileSight DeviceHub - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') may allow Unauthenticated RCE | [email protected] | 9.8 | 0.57% | 2024-06-02 | 2026-06-17 |
| CVE-2023-47166 | A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2. A specially crafted network request can lead to arbitrary firmware update. An attacker can send a network request to trigger this vulnerability. | [email protected] | 8.8 | 0.64% | 2024-05-01 | 2026-06-17 |
| CVE-2023-43260 | Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the admin panel. | [email protected] | 6.1 | 0.37% | 2023-10-05 | 2026-06-17 |
| CVE-2023-43261 | An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components. | [email protected] | 7.5 | 59.34% | 2023-10-04 | 2026-07-08 |
| CVE-2023-25583 | Two OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the code branch that manages a new vlan configuration. | [email protected] | 7.2 | 3.54% | 2023-07-06 | 2026-06-17 |
| CVE-2023-25582 | Two OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the code branch that manages an already existing vlan configuration. | [email protected] | 7.2 | 3.54% | 2023-07-06 | 2026-06-17 |
| CVE-2023-25124 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_openvpn_client function with the remote_subnet and the remote_mask variables. | [email protected] | 7.2 | 1.50% | 2023-07-06 | 2026-06-17 |
| CVE-2023-25123 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_openvpn_client function with the remote_subnet and the remote_mask variables when action is 2. | [email protected] | 7.2 | 1.46% | 2023-07-06 | 2026-06-17 |
| CVE-2023-25122 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_openvpn_client function with the old_remote_subnet and the old_remote_mask variables. | [email protected] | 7.2 | 1.46% | 2023-07-06 | 2026-06-17 |
| CVE-2023-25121 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_ike_profile function with the secrets_local variable. | [email protected] | 7.2 | 1.46% | 2023-07-06 | 2026-06-17 |
| CVE-2023-25120 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_dmvpn function with the cisco_secret variable. | [email protected] | 7.2 | 1.46% | 2023-07-06 | 2026-06-17 |
| CVE-2023-25119 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_pptp function with the remote_subnet and the remote_mask variables. | [email protected] | 7.2 | 1.46% | 2023-07-06 | 2026-06-17 |
| CVE-2023-25118 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_openvpn_client function with the username and the password variables. | [email protected] | 7.2 | 1.46% | 2023-07-06 | 2026-06-17 |
| CVE-2023-25117 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_openvpn_client function with the local_virtual_ip and the local_virtual_mask variables. | [email protected] | 7.2 | 1.46% | 2023-07-06 | 2026-06-17 |