CVE-2023-34551
Last modified
CVE-2023-34551 is a high-severity vulnerability rated 8/10 on the CVSS scale. In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ SDK command server can allow an authenticated attacker present on the same local network as the camera to achieve remote code execution. This affects CS-C6N-B0-1G2WF Firmware versions before V5.3.0 build 230215 and CS-C6N-R101-1G2WF Firmware versions before V5.3.0 build 230215 and CS-CV310-A0-1B2WFR Firmware versions before V5.3.0 build 230221 and CS-CV310-A0-1C2WFR-C Firmware versions before V5.3.2 build 230221 and CS-C6N-A0-1C2WFR-MUL Firmware versions before V5.3.2 build 230218 and CS-CV310-A0-3C2WFRL-1080p Firmware versions before V5.2.7 build 230302 and CS-CV310-A0-1C2WFR Wifi IP66 2.8mm 1080p Firmware versions before V5.3.2 build 230214 and CS-CV248-A0-32WMFR Firmware versions before V5.2.3 build 230217 and EZVIZ LC1C Firmware versions before V5.3.4 build 230214. EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ SDK command server can allow an authenticated attacker present on the same local network as the camera to achieve remote code execution. This affects CS-C6N-B0-1G2WF Firmware versions before V5.3.0 build 230215 and CS-C6N-R101-1G2WF Firmware versions before V5.3.0 build 230215 and CS-CV310-A0-1B2WFR Firmware versions before V5.3.0 build 230221 and CS-CV310-A0-1C2WFR-C Firmware versions before V5.3.2 build 230221 and CS-C6N-A0-1C2WFR-MUL Firmware versions before V5.3.2 build 230218 and CS-CV310-A0-3C2WFRL-1080p Firmware versions before V5.2.7 build 230302 and CS-CV310-A0-1C2WFR Wifi IP66 2.8mm 1080p Firmware versions before V5.3.2 build 230214 and CS-CV248-A0-32WMFR Firmware versions before V5.2.3 build 230217 and EZVIZ LC1C Firmware versions before V5.3.4 build 230214. The impact is: execute arbitrary code (remote).
Metrics
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ezviz | Cs-C6n-B0-1g2wf Firmware | <= 5.3.0 |
| Ezviz | Cs-C6n-R101-1g2wf Firmware | <= 5.3.0 |
| Ezviz | Cs-Cv310-A0-1b2wfr Firmware | <= 5.3.0 |
| Ezviz | Cs-Cv310-A0-1c2wfr-C Firmware | <= 5.3.2 |
| Ezviz | Cs-C6n-A0-1c2wfr-Mul Firmware | <= 5.3.2 |
| Ezviz | Cs-Cv310-A0-3c2wfrl-1080p Firmware | <= 5.2.7 |
| Ezviz | Cs-Cv310-A0-1c2wfr Firmware | <= 5.3.2 |
| Ezviz | Cs-Cv248-A0-32wmfr Firmware | <= 5.2.3 |
| Ezviz | Lc1c Firmware | <= 5.3.4 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-34551?
How severe is CVE-2023-34551?
How do I fix CVE-2023-34551?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-3454Remote code execution (RCE) vulnerability in Brocade Fabric …9.8
- CVE-2023-34540Langchain before v0.0.225 was discovered to contain a remote…9.8
- CVE-2023-34541Langchain 0.0.171 is vulnerable to Arbitrary code execution …9.8
- CVE-2023-34545A SQL injection vulnerability in CSZCMS 1.3.0 allows remote …9.8
- CVE-2023-34548Simple Customer Relationship Management 1.0 is vulnerable to…9.8
- CVE-2023-3455Key management vulnerability on system. Successful exploitat…9.1
- CVE-2023-34552In certain EZVIZ products, two stack based buffer overflows …8.8
- CVE-2023-34553An issue was discovered in WAFU Keyless Smart Lock v1.0 allo…6.5
- CVE-2023-3456Vulnerability of kernel raw address leakage in the hang det…5.3
- CVE-2023-34561A buffer overflow in the level parsing code of RobTop Games …9.8
- CVE-2023-34563netgear R6250 Firmware Version 1.0.4.48 is vulnerable to Buf…9.8
- CVE-2023-34565Netbox 3.5.1 is vulnerable to Cross Site Scripting (XSS) in …5.4
Are you affected by CVE-2023-34551?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST