CVE-2023-43261: Milesight UR5x Information Disclosure

CVE-2023-43261 Overview

CVE-2023-43261 is an information disclosure vulnerability affecting multiple Milesight industrial router models, including the UR5X, UR32L, UR32, UR35, and UR41 series. This vulnerability allows unauthenticated attackers to access sensitive router components via the network, potentially exposing credentials and other confidential configuration data. The vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File), indicating that sensitive data may be improperly stored or exposed through logging mechanisms.

Industrial routers are critical components in operational technology (OT) environments, often bridging IT networks with industrial control systems. The exposure of credentials or configuration data from these devices could enable attackers to gain unauthorized access to sensitive industrial networks, potentially leading to further compromise of connected systems.

Critical Impact

Unauthenticated remote attackers can access sensitive router components including credentials, potentially compromising industrial network infrastructure and connected OT systems.

Affected Products

• Milesight UR5X Series Firmware (UR51, UR52, UR55) before v35.3.0.7
• Milesight UR32L Firmware before v35.3.0.7
• Milesight UR32 Firmware before v35.3.0.7
• Milesight UR35 Firmware before v35.3.0.7
• Milesight UR41 Firmware before v35.3.0.7

Discovery Timeline

• 2023-10-04 - CVE-2023-43261 published to NVD
• 2025-05-01 - Last updated in NVD database

Technical Details for CVE-2023-43261

Vulnerability Analysis

This information disclosure vulnerability allows attackers to access sensitive router components without authentication. The underlying weakness is related to CWE-532 (Insertion of Sensitive Information into Log File), suggesting that the affected Milesight routers may store or expose sensitive information such as credentials in an insecure manner that can be accessed remotely.

The vulnerability is network-exploitable without requiring user interaction or authentication, making it particularly dangerous for internet-exposed devices. Successful exploitation results in high confidentiality impact, as attackers can retrieve sensitive configuration and credential data from the affected routers.

Industrial routers like the Milesight UR series are commonly deployed in critical infrastructure, manufacturing, and industrial IoT environments. The exposure of credentials could allow attackers to gain administrative access to the router, reconfigure network settings, intercept traffic, or use the compromised device as a pivot point for lateral movement into connected industrial networks.

Root Cause

The root cause of this vulnerability is the improper handling of sensitive information within the router's firmware. The affected devices appear to store or expose sensitive data—such as authentication credentials—in a manner accessible to unauthenticated remote users. This may involve log files, configuration backups, or other system components that inadvertently contain or expose credential information without proper access controls.

Attack Vector

The attack vector is network-based, allowing remote exploitation without authentication or user interaction. An attacker with network access to a vulnerable Milesight router can exploit this vulnerability to retrieve sensitive information, including router credentials.

The exploitation process involves accessing specific router endpoints or files that contain sensitive information. According to available research, this includes credential leakage that enables unauthorized access to the router's administrative interface. Once credentials are obtained, an attacker can gain full administrative control over the router.

For technical details on the exploitation methodology, refer to the GitHub CVE-2023-43261 Repository and the Medium Blog on Router Access.

Detection Methods for CVE-2023-43261

Indicators of Compromise

• Unexpected or unauthorized access to router management interfaces
• Authentication attempts using credentials not known to administrators
• Unusual outbound connections from router devices to unknown IP addresses
• Configuration changes made without administrator authorization
• Log entries showing access to sensitive system files or endpoints from external IP addresses

Detection Strategies

• Monitor network traffic to Milesight routers for unusual access patterns, particularly requests to configuration or log endpoints
• Implement network segmentation and monitor for unauthorized access attempts from untrusted network zones
• Deploy intrusion detection systems (IDS) with signatures for known exploitation patterns targeting Milesight devices
• Review authentication logs for successful logins from unexpected sources or at unusual times

Monitoring Recommendations

• Enable comprehensive logging on all Milesight routers and forward logs to a centralized SIEM
• Establish baseline network behavior for industrial routers and alert on deviations
• Monitor for reconnaissance activities targeting router management ports (typically HTTP/HTTPS on ports 80/443)
• Implement network flow analysis to detect data exfiltration from router devices

How to Mitigate CVE-2023-43261

Immediate Actions Required

• Upgrade all affected Milesight routers to firmware version v35.3.0.7 or later immediately
• Audit all Milesight router deployments to identify vulnerable devices and their network exposure
• Rotate all credentials (administrative passwords, API keys, VPN credentials) stored on or accessed through affected routers
• Implement network segmentation to restrict access to router management interfaces from untrusted networks
• Disable internet-facing management interfaces if remote administration is not required

Patch Information

Milesight has released firmware version v35.3.0.7 which addresses this vulnerability. Administrators should obtain the latest firmware from the Milesight IoT Support Page and apply updates to all affected device models including UR5X (UR51, UR52, UR55), UR32L, UR32, UR35, and UR41 series routers.

Before applying firmware updates, back up current router configurations and schedule maintenance windows to minimize operational disruption. Verify firmware integrity using checksums provided by the vendor before installation.

Workarounds

• Restrict network access to router management interfaces using firewall rules or access control lists (ACLs)
• Place all Milesight routers behind a VPN gateway, requiring VPN authentication before management access
• Disable unnecessary services and close unused ports on affected devices
• Implement IP whitelisting to limit management interface access to known administrator IP addresses
• Monitor affected devices closely for signs of exploitation until patches can be applied

# Example: Firewall rule to restrict management access (adapt to your environment)
# Allow management access only from trusted admin subnet
iptables -A INPUT -p tcp --dport 443 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP