Potential Information Disclosure CVE-2023-43261 Exploitation - Proxy

SigmaHQ Detections@sigmaHQ

•updated Sep 2, 2024•0•20

Detects exploitation attempts of CVE-2023-43261, an information disclosure vulnerability in Milesight UR5X, UR32L, UR32, UR35, UR41 routers before v35.3.0.7. Attackers can access sensitive router components, specifically the 'httpd.log' file, through proxy logs. This rule looks for GET requests to the '/lang/log/httpd.log' path with a successful HTTP status code (200).