Security readout for executives and security teams
Plain-English summary
CVE-2023-25121 affects Milesight UR32L routers running v32.3.0.5. A high-privileged attacker who can send crafted HTTP requests to the device can trigger a buffer overflow that may allow arbitrary code execution. This is serious for exposed or shared-admin environments, but the source bundle does not show public exploitation.
Executive priority
Treat as high priority for any deployed UR32L v32.3.0.5 devices, especially in remote sites or environments with broad admin access. Prioritize inventory, management-plane restriction, and vendor firmware review.
Technical view
The issue is a CWE-121 stack-based buffer overflow in the UR32L vtysh_ubus binary, caused by unsafe sprintf usage. The cited instance occurs in set_ike_profile using the secrets_local variable. CVSS 3.1 is 7.2, with network access, low complexity, high privileges, no user interaction, and high CIA impact.
Likely exposure
Exposure appears limited to Milesight UR32L devices on firmware v32.3.0.5 where high-privileged users or services can reach the HTTP management path. The bundle does not identify other affected versions or products.
Exploitation context
Sources say a specially crafted HTTP request can lead to arbitrary code execution, but require high privileges. CISA KEV is false in the bundle, and no cited source here confirms active exploitation.
Researcher notes
Evidence is specific but incomplete on remediation. Talos attributes the flaw to unsafe sprintf in vtysh_ubus and identifies set_ike_profile/secrets_local for this CVE. Avoid assuming broader Milesight exposure without vendor confirmation.
Mitigation direction
- Inventory Milesight UR32L devices and identify any running v32.3.0.5.
- Check Milesight and Talos guidance for fixed firmware or vendor-approved mitigation.
- Restrict HTTP management access to trusted administration networks only.
- Review and reduce high-privilege device accounts where operationally possible.
- Monitor administrative HTTP activity for unusual configuration changes.
Validation and detection
- Confirm model and firmware version from device management records.
- Verify management HTTP access is not reachable from untrusted networks.
- Review privileged account lists and recent administrative activity.
- Check whether vendor firmware guidance exists for CVE-2023-25121.
- Document compensating controls if no vendor fix is available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-25121 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H1.25.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.