PT-2023-6259 · Yifan · Yifan Yf325

Francesco Benvenuto · Publicado 2023-10-11 · Atualizado 2023-10-13 · CVE-2023-35055

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yifan YF325 version 1.0 20221108

Description A buffer overflow vulnerability exists in the httpd next page functionality, allowing an attacker to execute arbitrary commands by sending a specially crafted network request. The buffer overflow is located in the next page parameter of the gozila cgi function.

Recommendations For Yifan YF325 version 1.0 20221108, consider disabling the gozila cgi function or restricting access to the next page parameter until a patch is available. Avoid using the next page parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Buffer Overflow

Enumeração de Fraquezas

CWE-121

CWE-120

Identificadores relacionados

BDU:2023-06968

CVE-2023-35055

Produtos afetados

Yifan Yf325

Referências · 8

• https://safe-surf.ru/upload/VULN-new/VULN.2023-10-18.1.pdf · Nota de Segurança
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1761 · Nota
• https://t.me/true_secator/4958 · Publicação no Telegram
• https://t.me/cvenotify/59387 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-35055 · Nota de Segurança
• https://t.me/cibsecurity/72113 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-06968 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-35055 · Aviso do Fabricante