Vulnerability in Milesight Industrial Routers Exposes Critical Infrastructure to Unauthorized Access

A vulnerability in industrial routers manufactured by Milesight, a Chinese IoT and video surveillance product maker, has recently come to light. Exploit and vulnerability intelligence firm, VulnCheck, has reported the possibility of the vulnerability being exploited in attacks. This raises concerns about the security of critical infrastructure systems that rely on these routers.

Overview of the vulnerability

The vulnerability, known as CVE-2023-43261, affects several UR-series industrial cellular routers from Milesight, mainly Ursalink models. This vulnerability exposes system log files, including the ‘httpd.log’ file, putting the devices at risk.

Implications of the exposed logs

The system log files contain sensitive information, most notably passwords for administrators and other users. This presents a significant risk as remote, unauthenticated attackers can exploit this vulnerability to gain unauthorized access to the targeted devices. Although the passwords are not stored in plain text in the log files, they can be easily cracked, thus compromising the security of the affected systems.

Disclosure and PoC exploit

Security researcher Bipin Jitiya recently disclosed the details of the vulnerability, shedding light on the potential risks involved. Jitiya also released a proof-of-concept (PoC) exploit, which serves as a demonstration of how attackers can take advantage of this vulnerability.

Patching the vulnerability

An analysis conducted by VulnCheck on various firmware versions suggests that CVE-2023-43261 has likely been patched for years. Keeping firmware versions up to date is crucial to ensure the security of industrial routers and protect against potential exploits.

Scope of affected devices

Approximately 5,500 internet-exposed Milesight devices were identified using search engines like Shodan and Censys. However, only a small percentage, around 6.5% (less than 400 devices), appear to be running vulnerable firmware versions. This indicates that the majority of the devices may have already been patched, reducing their vulnerability to attacks.

Instances of Exploitation

Although the number of vulnerable devices seems relatively low, VulnCheck has observed what appears to be small-scale exploitation of this vulnerability. The attackers have been targeting specific systems in France, Lithuania, and Norway, attempting to log into six different systems. These attacks highlight the urgent need for remediation and heightened security measures.

Impact on ICS networks

Alarmingly, some victims had configured VPN servers, providing an entry point for the attacker. By exposing clear text credentials, the attacker can pivot into the Industrial Control Systems (ICS) network, potentially causing severe consequences. This emphasizes the importance of securing not only the routers but also the networks they connect to.

Usage of UR-series routers

Milesight’s UR-series routers find applications in various fields, including industrial automation, self-service kiosks, traffic lighting, smart grid assets, medical equipment, and retail. These critical infrastructure systems rely on the routers for uninterrupted operations, making the security of these devices of paramount importance.

The vulnerability in Milesight industrial routers raises serious concerns about the security of critical infrastructure systems. The exposure of system log files containing passwords provides unauthorized access to malicious actors, compromising the integrity of industrial processes. While the vendor claims to have patched most devices, it is imperative that users keep their firmware up to date and implement proactive security measures. Safeguarding these devices directly contributes to the protection of essential services and ensures the resilience of our critical infrastructure in an increasingly connected world.

Explore more

Can Federal Lands Power the Future of AI Infrastructure?

I’m thrilled to sit down with Dominic Jainy, an esteemed IT professional whose deep knowledge of artificial intelligence, machine learning, and blockchain offers a unique perspective on the intersection of technology and federal policy. Today, we’re diving into the US Department of Energy’s ambitious plan to develop a data center at the Savannah River Site in South Carolina. Our conversation

Can Your Mouse Secretly Eavesdrop on Conversations?

In an age where technology permeates every aspect of daily life, the notion that a seemingly harmless device like a computer mouse could pose a privacy threat is startling, raising urgent questions about the security of modern hardware. Picture a high-end optical mouse, designed for precision in gaming or design work, sitting quietly on a desk. What if this device,

Building the Case for EDI in Dynamics 365 Efficiency

In today’s fast-paced business environment, organizations leveraging Microsoft Dynamics 365 Finance & Supply Chain Management (F&SCM) are increasingly faced with the challenge of optimizing their operations to stay competitive, especially when manual processes slow down critical workflows like order processing and invoicing, which can severely impact efficiency. The inefficiencies stemming from outdated methods not only drain resources but also risk

Structured Data Boosts AI Snippets and Search Visibility

In the fast-paced digital arena where search engines are increasingly powered by artificial intelligence, standing out amidst the vast online content is a formidable challenge for any website. AI-driven systems like ChatGPT, Perplexity, and Google AI Mode are redefining how information is retrieved and presented to users, moving beyond traditional keyword searches to dynamic, conversational summaries. At the heart of

How Is Oracle Boosting Cloud Power with AMD and Nvidia?

In an era where artificial intelligence is reshaping industries at an unprecedented pace, the demand for robust cloud infrastructure has never been more critical, and Oracle is stepping up to meet this challenge head-on with strategic alliances that promise to redefine its position in the market. As enterprises increasingly rely on AI-driven solutions for everything from data analytics to generative