CVE-2023-47166

The Milesight UR32L cellular router has a firmware-update flaw in its luci2-io file-import functionality: a specially crafted network request can push an arbitrary firmware image onto the device. The advisory pairs a missing-authentication weakness with a broken-authorization one, and the vector needs only low privileges — so an attacker who can reach the interface can overwrite the device's own operating firmware. That's the deepest form of control there is over an embedded device.

Arbitrary firmware update is worse than ordinary RCE because it's persistence by design: a malicious image survives reboots and factory resets and can be crafted to hide itself, turning the router into a durable implant. Industrial cellular routers like the UR32L often sit at remote sites bridging OT and the internet, which makes them attractive footholds and hard to physically inspect once subverted.

We treat this as a high-priority persistence risk and focus on reachability and integrity. The questions we drive are whether the device's management interface is exposed beyond a trusted segment and which UR32L units are below the fixed firmware. Because a compromised image can outlast normal remediation, any device we suspect was reachable during the exposure window is a re-flash-and-verify candidate, not just a patch target.