CVE-2023-4249
Assigner: icscert
Published: 2023-11-08T22:51:25.143Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: IP Camera CF7500
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera CF7300
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera CF7201
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera CF7501
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera CB3211
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera CB3212
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera CB5220
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera CB6231
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera B8520
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera B8220
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
defaultStatus: unaffected
product: IP Camera CD321
vendor: Zavio
versions: status: affected
version: version M2.1.6.05
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Attila Szasz 
datePublic: 2023-10-31T20:34:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220,
 CB6231, B8520, B8220, and CD321 

<span style="background-color: rgb(255, 255, 255);">IP Cameras </span>

with firmware version M2.1.6.05 has a 
command injection vulnerability in their implementation of their 
binaries and handling of network requests.


value: Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220,
 CB6231, B8520, B8220, and CD321 

IP Cameras 

with firmware version M2.1.6.05 has a 
command injection vulnerability in their implementation of their 
binaries and handling of network requests.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-121
description: CWE-121 Stack-Based Buffer Overflow
type: CWE
source: advisory: ICSA-23-304-03
discovery: EXTERNAL
title: Zavio IP Camera Stack-Based Buffer Overflow
workarounds: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">The affected products are end-of-life and have been identified to contain many insecurities. The vendor, Zavio, is no longer actively in business and therefore development for firmware fixes, mitigations, and updates are not available and will not become available. CISA recommends users discontinue use of the product.</span>

<br>
value: 
The affected products are end-of-life and have been identified to contain many insecurities. The vendor, Zavio, is no longer actively in business and therefore development for firmware fixes, mitigations, and updates are not available and will not become available. CISA recommends users discontinue use of the product.



x_generator: engine: Vulnogram 0.1.0-dev