CVE-2023-45225: Zavio IP Camera Stack-Based Buffer Overflow

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-08 · updated 2026-06-17
Weakness: CWE-121

Description

Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. While parsing certain XML elements from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.

Affected products

Zavio B8220 Firmware: m2.1.6.05
Zavio B8520 Firmware: m2.1.6.05
Zavio Cb3211 Firmware: m2.1.6.05
Zavio Cb3212 Firmware: m2.1.6.05
Zavio Cb5220 Firmware: m2.1.6.05
Zavio Cb6231 Firmware: m2.1.6.05
Zavio Cd321 Firmware: m2.1.6.05
Zavio Cf7201 Firmware: m2.1.6.05
Zavio Cf7300 Firmware: m2.1.6.05
Zavio Cf7500 Firmware: m2.1.6.05
Zavio Cf7501 Firmware: m2.1.6.05

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03
https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03

Get alerted when CVE-2023-45225 or the next vulnerability affects your stack