Web exploitation attempts for CVE-2023-43261 causing info disclosure in Milesight routers
Alerts on successful GET requests for /lang/log/httpd.log in Milesight router web access logs, consistent with CVE-2023-43261 disclosure attempts.
- Category
- webserver
- Author
- Nasreddine Bencherchali (Nextron Systems), Thurein Oo (SigmaHQ), DRL 1.1
- Published
- 2023-10-20
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags HTTP GET requests that return a 200 status while the requested URI contains /lang/log/httpd.log (including .old variants), indicating attempts to access sensitive router components referenced in the access logs. Such behavior matters because it aligns with exploitation of CVE-2023-43261-style information disclosure paths. Telemetry required includes webserver access-log fields for HTTP method, requested URI stem, and response status from the affected Milesight router web interface.
Reporting behind it
- thehackernews.comhttps://thehackernews.com/2023/10/experts-warn-of-severe-flaws-affecting.html
- medium.comhttps://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
- github.comhttps://github.com/win3zz/CVE-2023-43261
- vulncheck.comhttps://vulncheck.com/blog/real-world-cve-2023-43261
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-43261/web_exploit_cve_2023_43261_milesight_information_disclosure.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Web exploitation attempts for CVE-2023-43261 causing info disclosure in Milesight routers
id: 4508c08f-f5a4-4f8f-a0b2-a7e0b4941b88
related:
- id: f48f5368-355c-4a1b-8bf5-11c13d589eaa
type: similar
- id: a2bcca38-9f3a-4d5e-b603-0c587e8569d7
type: derived
status: test
description: This rule flags HTTP GET requests that return a 200 status while the requested URI contains /lang/log/httpd.log (including .old variants), indicating attempts to access sensitive router components referenced in the access logs. Such behavior matters because it aligns with exploitation of CVE-2023-43261-style information disclosure paths. Telemetry required includes webserver access-log fields for HTTP method, requested URI stem, and response status from the affected Milesight router web interface.
references:
- https://thehackernews.com/2023/10/experts-warn-of-severe-flaws-affecting.html
- https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
- https://github.com/win3zz/CVE-2023-43261
- https://vulncheck.com/blog/real-world-cve-2023-43261
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-43261/web_exploit_cve_2023_43261_milesight_information_disclosure.yml
author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo, Huntrule Team
date: 2023-10-20
modified: 2023-10-30
tags:
- attack.initial-access
- attack.t1190
- cve.2023-43621
- detection.emerging-threats
logsource:
category: webserver
definition: "Requirements: In order for this detection to trigger, access logs of the router must be collected."
detection:
selection:
cs-method: GET
cs-uri-stem|contains: /lang/log/httpd.log
sc-status: 200
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1