What’s Vulnerable › Vulnerabilities

CVE-2023-43260

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-05 · updated 2026-06-17
• Weakness: CWE-79

Description

Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the admin panel.

Affected products

• Milesight Ur32 Firmware: before 35.3.0.7 — fixed in 35.3.0.7
• Milesight UR32L: before 35.3.0.7 — fixed in 35.3.0.7
• Milesight Ur35 Firmware: before 35.3.0.7 — fixed in 35.3.0.7
• Milesight Ur41 Firmware: before 35.3.0.7 — fixed in 35.3.0.7
• Milesight Ur51 Firmware: before 35.3.0.7 — fixed in 35.3.0.7
• Milesight Ur52 Firmware: before 35.3.0.7 — fixed in 35.3.0.7
• Milesight Ur55 Firmware: before 35.3.0.7 — fixed in 35.3.0.7

How to fix

Upgrade to a fixed version: Milesight Ur32 Firmware 35.3.0.7; Milesight UR32L 35.3.0.7; Milesight Ur35 Firmware 35.3.0.7; Milesight Ur41 Firmware 35.3.0.7; Milesight Ur51 Firmware 35.3.0.7; Milesight Ur52 Firmware 35.3.0.7; Milesight Ur55 Firmware 35.3.0.7. Check the vendor advisory for mitigations.

References

• https://gist.github.com/win3zz/c7eda501edcf5383df32fabe00938d13
• https://gist.github.com/win3zz/c7eda501edcf5383df32fabe00938d13

Get alerted when CVE-2023-43260 or the next vulnerability affects your stack