CVE-2023-23546: TALOS-2023-1705 || Cisco Talos Intelligence Group

SUMMARY

A misconfiguration vulnerability exists in the urvpn_client functionality of Milesight UR32L v32.3.0.5. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.

CONFIRMED VULNERABLE VERSIONS

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

Milesight UR32L v32.3.0.5

PRODUCT URLS

UR32L - https://www.milesight-iot.com/cellular/router/ur32l/

CVSSv3 SCORE

4.2 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE

CWE-295 - Improper Certificate Validation

DETAILS

The Milesight UR32L is an industrial radio router. The router features include support for multiple VPNs, a router console shell, firewall and many others.

The router offers a service called Milesight VPN that is a VPN service that will connect to the Milesight VPN software. The binary client used for this service is urvpn_client. The binary uses openSSL to ensure an encrypted communications with the VPN server:

void init_SSL_context(void)

{
  SSL_METHOD *methods;
  ulong e;
  char *pcVar1;

  SSL_init();
  if (SSL_CTX == (SSL_CTX *)0x0) {
    methods = SSLv23_client_method();
    SSL_CTX = SSL_CTX_new(methods);
    if (SSL_CTX == (SSL_CTX *)0x0) {
      e = ERR_get_error();
      pcVar1 = ERR_reason_error_string(e);
      log_message("crypto.c",0x65,"crypto_connection_create_TLS_context",3,
                  "SSL context initialization failed: %s",pcVar1);
    }
  }
  return;
}

The init_SSL_context shows that no SSL_CTX_set_verify function was used. No other options, to verify peer certificates, are used. Furthermore, it seems impossible to upload any type of certificate to validate the server, indeed, the client does not verify the certificate provided by the server and so the device is vulnerable to a man-in-the-middle-attack.

VENDOR RESPONSE

Since the maintainer of this software did not release a patch during the 90 day window specified in our policy, we have now decided to release the information regarding this vulnerability, to make users of the software aware of this problem. See Cisco’s Coordinated Vulnerability Disclosure Policy for more information: https://tools.cisco.com/security/center/resources/vendor_vulnerability_policy.html

TIMELINE

2023-02-14 - Initial Vendor Contact
2023-02-21 - Vendor Disclosure
2023-07-06 - Public Release

Discovered by Francesco Benvenuto of Cisco Talos.