CVE-2023-4249

published 2023-11-08

CVE-2023-4249: Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 has a command…

Priority P2 71 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220,
CB6231, B8520, B8220, and CD321

IP Cameras

with firmware version M2.1.6.05 has a
command injection vulnerability in their implementation of their
binaries and handling of network requests.

Affected

22 ranges

Vendor	Product	Version range	Fixed in
zavio	b8220_firmware	—	—
zavio	b8520_firmware	—	—
zavio	cb3211_firmware	—	—
zavio	cb3212_firmware	—	—
zavio	cb5220_firmware	—	—
zavio	cb6231_firmware	—	—
zavio	cd321_firmware	—	—
zavio	cf7201_firmware	—	—
zavio	cf7300_firmware	—	—
zavio	cf7500_firmware	—	—
zavio	cf7501_firmware	—	—
zavio	ip_camera_b8220	—	—
zavio	ip_camera_b8520	—	—
zavio	ip_camera_cb3211	—	—
zavio	ip_camera_cb3212	—	—
zavio	ip_camera_cb5220	—	—
zavio	ip_camera_cb6231	—	—
zavio	ip_camera_cd321	—	—
zavio	ip_camera_cf7201	—	—
zavio	ip_camera_cf7300	—	—
zavio	ip_camera_cf7500	—	—
zavio	ip_camera_cf7501	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Target devices are Zavio IP Cameras (CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, CD321) running firmware version M2.1.6.05 — detect exploitation attempts against these devices on the network ↗
• → The OS command injection (CVE-2023-4249) is triggered via incoming network requests — monitor for anomalous or malformed network requests to Zavio IP camera HTTP/management interfaces, particularly those carrying OS command metacharacters ↗
• → Related stack-based buffer overflow vulnerabilities (CVE-2023-3959, CVE-2023-45225, CVE-2023-43755, CVE-2023-39435) on the same firmware are triggered via XML elements in incoming network requests — inspect network traffic for oversized or malformed XML payloads destined for Zavio camera interfaces ↗
• → CVE-2023-4249 requires low-privilege authentication (PR:L) — alert on any authenticated session to a Zavio IP camera (firmware M2.1.6.05) that subsequently triggers unexpected process spawning or shell execution ↗

• · Affected products are end-of-life with no firmware fix available; vendor (Zavio) is no longer in business — no patch-based remediation exists ↗
• · No known public exploitation of CVE-2023-4249 had been reported to CISA at time of advisory publication (October 31, 2023) ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121 CWE-78