cbcvebase.
CVE-2023-3959
published 2023-11-08

CVE-2023-3959: Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to…

PriorityP276critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
40.40%
98.5th percentile
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. While processing XML elements from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.

Affected

22 ranges
VendorProductVersion rangeFixed in
zaviob8220_firmware——
zaviob8520_firmware——
zaviocb3211_firmware——
zaviocb3212_firmware——
zaviocb5220_firmware——
zaviocb6231_firmware——
zaviocd321_firmware——
zaviocf7201_firmware——
zaviocf7300_firmware——
zaviocf7500_firmware——
zaviocf7501_firmware——
zavioip_camera_b8220——
zavioip_camera_b8520——
zavioip_camera_cb3211——
zavioip_camera_cb3212——
zavioip_camera_cb5220——
zavioip_camera_cb6231——
zavioip_camera_cd321——
zavioip_camera_cf7201——
zavioip_camera_cf7300——
zavioip_camera_cf7500——
zavioip_camera_cf7501——

Detection & IOCsextracted from sources · hover to see the quote

  • →Trigger vector is incoming network requests containing XML elements; monitor for malformed or oversized XML payloads sent to Zavio IP Camera HTTP/network service ports ↗
  • →Affected firmware version is M2.1.6.05 across all listed Zavio IP Camera models (CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, CD321); fingerprint devices running this version as high-priority targets ↗
  • →Vulnerability is exploitable remotely with no authentication and low attack complexity (CVSS AV:N/AC:L/PR:N/UI:N); prioritize blocking unauthenticated external access to these devices at the network perimeter ↗
  • →Stack-based buffer overflow is triggered during processing and parsing of specific XML element fields from network requests; inspect network traffic for unusually large XML field values destined for Zavio camera endpoints ↗
  • ·Affected products are end-of-life with no firmware fix available; vendor Zavio is no longer in business, so no patch-based remediation exists — detection and network isolation are the only mitigations ↗
  • ·No known public exploitation has been reported at time of advisory publication; however, CVSS 9.8 score and unauthenticated remote vector make these devices extremely high risk if internet-exposed ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.