CVE-2023-43755
Assigner: icscert
Published: 2023-11-08T22:57:59.332Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: IP Camera CF7500
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera CF7300
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera CF7201
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera CF7501
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera CB3211
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera CB3212
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera CB5220
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera CB6231
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera B8520
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera B8220
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera CD321
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Attila Szasz 
datePublic: 2023-10-31T20:34:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220,
 CB6231, B8520, B8220, and CD321 

<span style="background-color: rgb(255, 255, 255);">IP Cameras </span>

with firmware version M2.1.6.05 are 
vulnerable to multiple instances of stack-based overflows. During the 
processing and parsing of certain fields in XML elements from incoming 
network requests, the product does not sufficiently check or validate 
allocated buffer size. This may lead to remote code execution.


value: Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220,
 CB6231, B8520, B8220, and CD321 

IP Cameras 

with firmware version M2.1.6.05 are 
vulnerable to multiple instances of stack-based overflows. During the 
processing and parsing of certain fields in XML elements from incoming 
network requests, the product does not sufficiently check or validate 
allocated buffer size. This may lead to remote code execution.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-121
description: CWE-121 Stack-Based Buffer Overflow
type: CWE
source: advisory: ICSA-23-304-03
discovery: EXTERNAL
title: Zavio IP Camera Stack-Based Buffer Overflow
workarounds: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">The affected products are end-of-life and have been identified to contain many insecurities. The vendor, Zavio, is no longer actively in business and therefore development for firmware fixes, mitigations, and updates are not available and will not become available. CISA recommends users discontinue use of the product.</span>

<br>
value: 
The affected products are end-of-life and have been identified to contain many insecurities. The vendor, Zavio, is no longer actively in business and therefore development for firmware fixes, mitigations, and updates are not available and will not become available. CISA recommends users discontinue use of the product.



x_generator: engine: Vulnogram 0.1.0-dev