CVE-2023-24519 - CVE House

Back to Database

Status published High CVE-2023-24519

Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1...

8.8 CVSS

Vulnerability Description

Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the ping tool utility.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-24519

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Discovered by Francesco Benvenuto of Cisco Talos.

References

https://talosintelligence.com/vulnerability_reports/TALOS-2023-1706

More from Milesight

View All →

Milesight UG65-868M-EA Improper Access Control for Volatile Memory Containing Boot Code

A firmware update vulnerability exists in the luci2-io file-import functionality...

Milesight NCR/Camera Authentication Bypass

Improper Authorization Vulnerability in Milesight Network Video Recorder (NVR)

Authentication Bypass Vulnerability in Milesight Network Video Recorder (NVR)

Affected Vendor

Milesight

View all reports →

Affected Software

UR32L

Vulnerable Versions:

v32.3.0.5

Timeline

Official Publish: July 6th, 2023

Last Modified: November 4th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1105 Ingress Tool Transfer

Command and Control