Milesight Routers - Information Disclosure

highseverity

7.5CVSS score

63.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

A critical security vulnerability has been identified in Milesight Industrial Cellular Routers, compromising the security of sensitive credentials and permitting unauthorized access. This vulnerability stems from a misconfiguration that results in directory listing being enabled on the router systems, rendering log files publicly accessible. These log files, while containing sensitive information such as admin and other user passwords (encrypted as a security measure), can be exploited by attackers via the router's web interface. The presence of a hardcoded AES secret key and initialization vector (IV) in the JavaScript code further exacerbates the situation, facilitating the decryption of these passwords. This chain of vulnerabilities allows malicious actors to gain unauthorized access to the router.

Impact

Unauthenticated attackers can access publicly exposed log files containing encrypted admin and user passwords, then decrypt them using the hardcoded AES key found in JavaScript code, gaining full administrative access to industrial cellular routers.

Fix

Update Milesight Industrial Cellular Router firmware to disable directory listing, restrict access to log files, and remove hardcoded cryptographic keys from the web interface.

How to confirm it

Send: GET {{BaseURL}}/lang/log/httpd.log

Run it with nuclei: nuclei -id CVE-2023-43261 -u <target>

The full check

id: CVE-2023-43261

info:
  name: Milesight Routers - Information Disclosure
  author: gy741
  severity: high
  description: |
    A critical security vulnerability has been identified in Milesight Industrial Cellular Routers, compromising the security of sensitive credentials and permitting unauthorized access. This vulnerability stems from a misconfiguration that results in directory listing being enabled on the router systems, rendering log files publicly accessible. These log files, while containing sensitive information such as admin and other user passwords (encrypted as a security measure), can be exploited by attackers via the router's web interface. The presence of a hardcoded AES secret key and initialization vector (IV) in the JavaScript code further exacerbates the situation, facilitating the decryption of these passwords. This chain of vulnerabilities allows malicious actors to gain unauthorized access to the router.
  impact: |
    Unauthenticated attackers can access publicly exposed log files containing encrypted admin and user passwords, then decrypt them using the hardcoded AES key found in JavaScript code, gaining full administrative access to industrial cellular routers.
  remediation: |
    Update Milesight Industrial Cellular Router firmware to disable directory listing, restrict access to log files, and remove hardcoded cryptographic keys from the web interface.
  reference:
    - https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
    - https://github.com/win3zz/CVE-2023-43261
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43261
    - http://milesight.com
    - http://ur5x.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-43261
    cwe-id: CWE-532
    epss-score: 0.63674
    epss-percentile: 0.99224
    cpe: cpe:2.3:h:milesight:ur51:-:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: milesight
    product: ur51
    shodan-query: http.html:rt_title
  tags: cve2023,cve,router,milesight,disclosure,unauth,iot,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/lang/log/httpd.log"

    max-size: 5000

    extractors:
      - type: regex
        regex:
          - '"username":"([^"]+)","password":"(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)"'

References

Use this check only on systems you are authorised to test. Where the data comes from