PT-2023-6163 · Yifan · Yifan Yf325

Francesco Benvenuto · Published 2023-06-20 · Updated 2023-10-13 · CVE-2023-35967

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Yifan YF325 version 1.0 20221108

Description Two heap-based buffer overflow vulnerabilities exist in the gwcfg cgi set manage post data functionality. A specially crafted network request can lead to a heap buffer overflow. An attacker can send a network request to trigger these vulnerabilities, potentially impacting the integrity, availability, and confidentiality of protected information. The integer overflow result is used as an argument for the malloc function.

Recommendations For Yifan YF325 version 1.0 20221108, as a temporary workaround, consider disabling the gwcfg cgi set manage post data function until a patch is available. Restrict access to the vulnerable functionality to minimize the risk of exploitation. Avoid using the vulnerable functionality in the affected device until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Integer Overflow

Weakness Enumeration

CWE-787

CWE-190

Related Identifiers

BDU:2023-06870

CVE-2023-35967

Affected Products

Yifan Yf325

References · 9

• https://safe-surf.ru/upload/VULN-new/VULN.2023-10-18.1.pdf · Security Note
• https://osv.dev/vulnerability/CVE-2023-35967 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06870 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-35967 · Security Note
• https://vuldb.com/ru/?id.241938 · Note
• https://t.me/true_secator/4958 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1788 · Note
• https://t.me/cibsecurity/72116 · Telegram Post
• https://t.me/cvenotify/59383 · Telegram Post