CVE-2023-39435: Zavio IP Camera Stack-Based Buffer Overflow

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-08 · updated 2026-06-17
Weakness: CWE-121

Description

Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to stack-based overflows. During the process of updating certain settings sent from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.

Affected products

Zavio B8220 Firmware: m2.1.6.05
Zavio B8520 Firmware: m2.1.6.05
Zavio Cb3211 Firmware: m2.1.6.05
Zavio Cb3212 Firmware: m2.1.6.05
Zavio Cb5220 Firmware: m2.1.6.05
Zavio Cb6231 Firmware: m2.1.6.05
Zavio Cd321 Firmware: m2.1.6.05
Zavio Cf7201 Firmware: m2.1.6.05
Zavio Cf7300 Firmware: m2.1.6.05
Zavio Cf7500 Firmware: m2.1.6.05
Zavio Cf7501 Firmware: m2.1.6.05

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03
https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03

Get alerted when CVE-2023-39435 or the next vulnerability affects your stack