What’s Vulnerable › Vulnerabilities

CVE-2023-4249: Zavio IP Camera Stack-Based Buffer Overflow

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 12.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-08 · updated 2026-06-17
• Weakness: CWE-121

Description

Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 has a command injection vulnerability in their implementation of their binaries and handling of network requests.

Affected products

• Zavio B8220 Firmware: m2.1.6.05
• Zavio B8520 Firmware: m2.1.6.05
• Zavio Cb3211 Firmware: m2.1.6.05
• Zavio Cb3212 Firmware: m2.1.6.05
• Zavio Cb5220 Firmware: m2.1.6.05
• Zavio Cb6231 Firmware: m2.1.6.05
• Zavio Cd321 Firmware: m2.1.6.05
• Zavio Cf7201 Firmware: m2.1.6.05
• Zavio Cf7300 Firmware: m2.1.6.05
• Zavio Cf7500 Firmware: m2.1.6.05
• Zavio Cf7501 Firmware: m2.1.6.05

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03

Get alerted when CVE-2023-4249 or the next vulnerability affects your stack