Critical vulnerability reported in Milesight UR32L industrial routers
Take action: This is a weird one - the vulnerability is reported but there is no patch or realistic mitigation measure. You can't magically turn off the routers or hide them behind an isolated network segments if they aren't placed there by design. The reality is that all you can do is be vigilant for a patch and hope for the best in the meantime.
Learn More
Cisco Talos, a renowned cybersecurity research group, has uncovered a total of sixty-three security vulnerabilities in the UR32L industrial routers manufactured by Milesight. These vulnerabilities were identified as part of an in-depth analysis conducted by the Talos researchers, who found some severe flaws that could potentially be exploited by malicious actors.
The most critical vulnerability, tracked as CVE-2023-23902 (CVSS3 score 9.8), could allow attackers to execute remote code on the routers by leveraging network requests. Such remote code execution attacks can give hackers unauthorized access to the affected routers, leading to potential disruptions in network operations and data breaches.
In addition to the severe vulnerability, there are several other high-severity bugs impacting the UR32L routers, which, if exploited, could result in arbitrary code execution or command execution. These vulnerabilities collectively pose a significant cyber threat to the routers' security and the networks they are connected to.
The researchers also discovered vulnerabilities in the MileSightVPN app, which is designed to enhance the security of the UR32L routers. These vulnerabilities could be exploited for malicious purposes, such as executing commands, evading authentication measures, reading arbitrary files, and injecting arbitrary JavaScript code. If attackers manage to exploit these vulnerabilities in conjunction with the flaws in the UR32L routers, they could carry out a single, comprehensive attack campaign, amplifying the potential damage.
Milesight, the manufacturer of the UR32L routers, is assuring customers of their commitment to addressing the identified issues. They claim to have already resolved certain issues and met the disclosure requirements demanded by clients in regulatory areas. Moreover, they state that a new firmware version has been tested in collaboration with Talos to improve the routers' security.
However, the situation is not resolved and there is no patch available as yet. Organizations relying on these routers are advised to monitor for release of the patch, and in the meantime to monitor their networks for unexpected increase in activity on their Milesight UR32L routers.
