What’s Vulnerable › Vulnerabilities

CVE-2023-43261

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 63.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-04 · updated 2026-07-09
• Weakness: CWE-532

Description

An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components.

Affected products

• Milesight Ur32 Firmware: before 35.3.0.7 — fixed in 35.3.0.7
• Milesight UR32L: before 35.3.0.7 — fixed in 35.3.0.7
• Milesight Ur35 Firmware: before 35.3.0.7 — fixed in 35.3.0.7
• Milesight Ur41 Firmware: before 35.3.0.7 — fixed in 35.3.0.7
• Milesight Ur5X Firmware: before 35.3.0.7 — fixed in 35.3.0.7

How to fix

Upgrade to a fixed version: Milesight Ur32 Firmware 35.3.0.7; Milesight UR32L 35.3.0.7; Milesight Ur35 Firmware 35.3.0.7; Milesight Ur41 Firmware 35.3.0.7; Milesight Ur5X Firmware 35.3.0.7. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/176988/Milesight-UR5X-UR32L-UR32-UR35-UR41-Credential-Leakage.html
• https://github.com/win3zz/CVE-2023-43261
• https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
• https://support.milesight-iot.com/support/home
• http://packetstormsecurity.com/files/176988/Milesight-UR5X-UR32L-UR32-UR35-UR41-Credential-Leakage.html
• https://github.com/win3zz/CVE-2023-43261
• https://medium.com/%40win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
• https://support.milesight-iot.com/support/home

Get alerted when CVE-2023-43261 or the next vulnerability affects your stack