CVE-2023-39435

Zavio IP Camera Stack-Based Buffer Overflow

State: Published
Severity: 8.8 High
Published: Nov 8, 2023
Updated: Jan 16, 2025
Reserved: Oct 10, 2023

Description

Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras

with firmware version M2.1.6.05 are vulnerable to stack-based overflows. During the process of updating certain settings sent from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	icscert

Weaknesses

CWE-121 Stack-Based Buffer Overflow

Affected Products

Product	Versions
IP Camera CF7500Zavio	version M2.1.6.05Affected
IP Camera CF7300Zavio	version M2.1.6.05Affected
IP Camera CF7201Zavio	version M2.1.6.05Affected
IP Camera CF7501Zavio	version M2.1.6.05Affected
IP Camera CB3211Zavio	version M2.1.6.05Affected
IP Camera CB3212Zavio	version M2.1.6.05Affected
IP Camera CB5220Zavio	version M2.1.6.05Affected
IP Camera CB6231Zavio	version M2.1.6.05Affected
IP Camera B8520Zavio	version M2.1.6.05Affected
IP Camera B8220Zavio	version M2.1.6.05Affected
IP Camera CD321Zavio	version M2.1.6.05Affected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.