Security readout for executives and security teams
Plain-English summary
CVE-2023-25110 is a high-severity memory corruption flaw in Milesight UR32L firmware v32.3.0.5. A highly privileged attacker who can reach the device over HTTP could trigger a buffer overflow and potentially run code on the device. This matters most where these routers are remotely administered or placed in operational networks.
Executive priority
Treat as a targeted remediation item for operational network devices. It is not shown as actively exploited, but successful exploitation could compromise router integrity and availability if an attacker already has high privileges.
Technical view
The issue is a CWE-121 buffer overflow in the vtysh_ubus binary, specifically the set_gre function handling remote_virtual_ip. The CVSS 3.1 score is 7.2. The attack vector is network-based with low complexity, but exploitation requires high privileges and no user interaction.
Likely exposure
Exposure appears limited to Milesight UR32L devices running v32.3.0.5. Risk is higher when authenticated administrative HTTP access is reachable from untrusted networks, vendors, or broad internal segments.
Exploitation context
The source bundle says a specially crafted HTTP request can lead to arbitrary code execution by an attacker with high privileges. CISA KEV status is false, and no provided source confirms active exploitation.
Researcher notes
Evidence supports a stack buffer overflow pattern tied to unsafe sprintf use in vtysh_ubus. The provided data identifies remote_virtual_ip in set_gre as the affected input path. Patch availability is not stated in the bundle, so verification should rely on vendor guidance.
Mitigation direction
- Identify Milesight UR32L devices and confirm firmware versions.
- Restrict HTTP management access to trusted administrative networks only.
- Review Milesight and Talos guidance for vendor-approved fixes or mitigations.
- Reduce and audit high-privilege accounts on affected devices.
- Monitor for unusual authenticated configuration changes involving GRE settings.
Validation and detection
- Check asset inventory for Milesight UR32L deployments.
- Verify whether any device runs firmware v32.3.0.5.
- Confirm management interfaces are not exposed to the internet.
- Review administrative access paths and high-privilege account usage.
- Inspect logs for unexpected authenticated HTTP configuration activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-25110 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H1.25.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.