CVE-2023-45225

Zavio IP Camera Stack-Based Buffer Overflow

State: Published
Severity: 9.8 Critical
Published: Nov 8, 2023
Updated: Jan 16, 2025
Reserved: Oct 10, 2023

Description

Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321

IP Cameras with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. While parsing certain XML elements from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	icscert

Weaknesses

CWE-121 Stack-Based Buffer Overflow

Affected Products

Product	Versions
IP Camera CF7500Zavio	version M2.1.6.05Affected
IP Camera CF7300Zavio	version M2.1.6.05Affected
IP Camera CF7201Zavio	version M2.1.6.05Affected
IP Camera CF7501Zavio	version M2.1.6.05Affected
IP Camera CB3211Zavio	version M2.1.6.05Affected
IP Camera CB3212Zavio	version M2.1.6.05Affected
IP Camera CB5220Zavio	version M2.1.6.05Affected
IP Camera CB6231Zavio	version M2.1.6.05Affected
IP Camera B8520Zavio	version M2.1.6.05Affected
IP Camera B8220Zavio	version M2.1.6.05Affected
IP Camera CD321Zavio	version M2.1.6.05Affected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.