Milesight

Records96All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical16CVSS 9.0–10.0

CVSS high74CVSS 7.0–8.9

Exploited now

Milesight records in CISA KEV

No Milesight vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

5 records in Milesightvpn · all components

TI-2023-08998 CVE-2023-22844 · GHSA-pxr7-xfv3-mwhv

HIGH 81

An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00759 Published 2023-07-06 No fix listed CWE-321

TI-2023-08584 CVE-2023-22319 · GHSA-m5cf-882p-58vh

HIGH 81

A sql injection vulnerability exists in the requestHandlers.js LoginAuth functionality of Milesight VPN v2.0.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00903 Published 2023-07-06 No fix listed CWE-89

TI-2023-08631 CVE-2023-22371 · GHSA-x4wh-ccmq-r3hv

HIGH 70

An os command injection vulnerability exists in the liburvpn.so create_private_key functionality of Milesight VPN v2.0.2.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.03444 Published 2023-07-06 No fix listed CWE-77

TI-2023-09705 CVE-2023-23907 · GHSA-mqv5-59xx-542r

MEDIUM 41

A directory traversal vulnerability exists in the server.js start functionality of Milesight VPN v2.0.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01242 Published 2023-07-06 No fix listed CWE-22

TI-2023-10117 CVE-2023-24496 · GHSA-x58f-rjp3-rh75

LOW 22

Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00572 Published 2023-07-06 No fix listed CWE-80