PT-2023-6249 · Yifan · Yifan Yf325

Francesco Benvenuto · Published 2023-06-28 · Updated 2023-10-13 · CVE-2023-35965

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Yifan YF325 version 1.0 20221108

Description The issue is related to two heap-based buffer overflow vulnerabilities in the httpd manage post functionality. A specially crafted network request can lead to a heap buffer overflow, allowing an attacker to send a request and trigger these vulnerabilities. The integer overflow result is used as an argument for the malloc function. This can potentially enable a remote attacker to execute arbitrary code.

Recommendations For Yifan YF325 version 1.0 20221108, consider disabling the manage post functionality in the httpd service until a patch is available to prevent exploitation of the heap buffer overflow vulnerabilities. Restrict access to the affected functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Memory Corruption

Weakness Enumeration

CWE-190

CWE-787

Related Identifiers

BDU:2023-06958

CVE-2023-35965

Affected Products

Yifan Yf325

References · 10

• https://bdu.fstec.ru/vul/2023-06958 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-35965 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2023-10-18.1.pdf · Security Note
• https://osv.dev/vulnerability/CVE-2023-35965 · Vendor Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1787 · Note
• https://t.me/cvenotify/59385 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023101624 · Note
• https://t.me/cibsecurity/72120 · Telegram Post
• https://vuldb.com/ru/?id.241936 · Note
• https://t.me/true_secator/4958 · Telegram Post