CVE-2023-35056
published 2023-10-11CVE-2023-35056: A buffer overflow vulnerability exists in the httpd next_page functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to…
PriorityP352critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.02%
59.0th percentile
A buffer overflow vulnerability exists in the httpd next_page functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability.This buffer overflow is in the next_page parameter in the cgi_handler function.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| yifan | yf325 | — | — |
| yifanwireless | yf325_firmware | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Talos
10 zero-day vulnerabilities in industrial cell router could lead to code execution, buffer overflows
blogs_talos·2023-10-11·CVSS 9.8
[CRITICAL] 10 zero-day vulnerabilities in industrial cell router could lead to code execution, buffer overflows
Cisco Talos recently disclosed 11 vulnerabilities, 10 of which are zero-days without a patch in an industrial cellular router.
Attackers could exploit these vulnerabilities in the Yifan YF325 to carry out a variety of attacks, in some cases gaining the ability to execute arbitrary shell commands on the targeted device.
The one other security issue Talos has disclosed over the past two weeks is a use-after-free vulnerability in an open-source port of WebKit, a popular content rendering engine used in popular web browsers like Apple Safari.
For Snort coverage that can detect the exploitation of these vulnerabilities, download the latest rule sets from Snort.org, and our latest Vulnerability Advisories are always posted on Talos Intelligence’s website.
## Yifan YF325
Discovered by France
Talos
10 zero-day vulnerabilities in industrial cell router could lead to code execution, buffer overflows
blogs_talos·2023-10-11·CVSS 9.8
[CRITICAL] 10 zero-day vulnerabilities in industrial cell router could lead to code execution, buffer overflows
## 10 zero-day vulnerabilities in industrial cell router could lead to code execution, buffer overflows
Cisco Talos recently disclosed 11 vulnerabilities, 10 of which are zero-days without a patch in an industrial cellular router.
Attackers could exploit these vulnerabilities in the Yifan YF325 to carry out a variety of attacks, in some cases gaining the ability to execute arbitrary shell commands on the targeted device.
The one other security issue Talos has disclosed over the past two weeks is a use-after-free vulnerability in an open-source port of WebKit, a popular content rendering engine used in popular web browsers like Apple Safari.
For Snort coverage that can detect the exploitation of these vulnerabilities, download the latest rule sets from Snort.org , and our latest Vulnera
2023-10-11
Published