CVE-2023-43261
An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components
CVSS
7.5
Alto
EPSS
59.6%
p99
KEV
—
Exploit Today
30
0-100
Publicado: 4 oct 2023 · Última mod.: 9 jul 2026 · CWE-532
59.3%EPSS · 30 días59.6%
2026-08-022026-08-31
An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components.
- packetstormsecurity.comhttp://packetstormsecurity.com/files/176988/Milesight-UR5X-UR32L-UR32-UR35-UR41-Credential-Leakage.html
- github.comhttps://github.com/win3zz/CVE-2023-43261
- medium.comhttps://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
- support.milesight-iot.comhttps://support.milesight-iot.com/support/home
- packetstormsecurity.comhttp://packetstormsecurity.com/files/176988/Milesight-UR5X-UR32L-UR32-UR35-UR41-Credential-Leakage.html
- github.comhttps://github.com/win3zz/CVE-2023-43261
- medium.comhttps://medium.com/%40win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
- support.milesight-iot.comhttps://support.milesight-iot.com/support/home
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-78174—23.1%
——7WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover.3dCVE-2026-815305.6 MED0.0%
——0A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked as other secret fields are. A party able to read the application's logs, diagnostic output, or a process memory dump may thereby recover the plaintext credentials and use them to decrypt protected field data.3dCVE-2026-593023.1 BAJ4.5%
——1Potential for logging sensitive data in Spring Cloud Stream.
Spring Cloud Stream 5.0.0 - 5.0.2
Spring Cloud Stream 4.3.0 - 4.3.3
Spring Cloud Stream 4.2.0 - 4.2.63dCVE-2026-593013.1 BAJ4.5%
——1Potential for logging sensitive data in Spring Cloud Function Azure.
Spring Cloud Function 5.0.0 - 5.0.3
Spring Cloud Function 4.3.0 - 4.3.4
Spring Cloud Function 4.2.0 - 4.2.73dCVE-2026-593003.1 BAJ4.5%
——1Potential for logging sensitive data in Spring Cloud Function AWS.
Spring Cloud Function 5.0.0 - 5.0.3
Spring Cloud Function 4.3.0 - 4.3.4
Spring Cloud Function 4.2.0 - 4.2.7
Spring Cloud Function 3.2.16 and earlier3dCVE-2026-817153.3 BAJ8.5%
——3openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to sanitize it. As a result the token is printed in cleartext to stderr under --debug (even without --unsafe-show-secrets), persisting the credential in logs and terminal history. Fixed in 1.4.9.3d