CVE-2023-39435
Zavio IP Camera Stack-Based Buffer Overflow
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to stack-based overflows. During the process of updating certain settings sent from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Zavio IP Camera CF7500
version M2.1.6.05
- Zavio IP Camera CF7300
version M2.1.6.05
- Zavio IP Camera CF7201
version M2.1.6.05
- Zavio IP Camera CF7501
version M2.1.6.05
- Zavio IP Camera CB3211
version M2.1.6.05
- Zavio IP Camera CB3212
version M2.1.6.05
- Zavio IP Camera CB5220
version M2.1.6.05
- Zavio IP Camera CB6231
version M2.1.6.05
- Zavio IP Camera B8520
version M2.1.6.05
- Zavio IP Camera B8220
version M2.1.6.05
- Zavio IP Camera CD321
version M2.1.6.05