PT-2023-6164 · Yifan · Yifan Yf325
Francesco Benvenuto
·
Published
2023-06-20
·
Updated
2023-10-13
·
CVE-2023-35968
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Yifan YF325 version 1.0 20221108
Description
The issue is related to the
gwcfg cgi set manage post data() function in the Yifan YF325 industrial Wi-Fi router's firmware, which is associated with a buffer overflow in memory. This can be exploited by a remote attacker by sending specially crafted requests, potentially affecting the integrity, availability, and confidentiality of protected information. The vulnerability involves a heap-based buffer overflow that can be triggered by a specially crafted network request, leading to an integer overflow result being used as an argument for the realloc function.Recommendations
For Yifan YF325 version 1.0 20221108, consider disabling the
gwcfg cgi set manage post data() function until a patch is available to prevent exploitation. Restrict access to the vulnerable functionality to minimize the risk of exploitation. Avoid using the vulnerable function to process network requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Integer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Yifan Yf325