PT-2023-6250 · Yifan · Yifan Yf325

Francesco Benvenuto

·

Published

2023-06-28

·

Updated

2023-10-13

·

CVE-2023-35966

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Yifan YF325 version 1.0 20221108
Description The issue is related to two heap-based buffer overflow vulnerabilities in the httpd manage post functionality. A specially crafted network request can lead to a heap buffer overflow, allowing an attacker to send a network request to trigger these vulnerabilities. The integer overflow result is used as an argument for the realloc function. This vulnerability can be exploited by a remote attacker to execute arbitrary code.
Recommendations For Yifan YF325 version 1.0 20221108, consider disabling the manage post functionality in the httpd service until a patch is available to prevent exploitation of the heap buffer overflow vulnerabilities. Restrict access to the httpd service to minimize the risk of exploitation. Avoid using the realloc function with unvalidated input to prevent integer overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Memory Corruption

Weakness Enumeration

CWE-190CWE-787

Related Identifiers

BDU:2023-06959
CVE-2023-35966

Affected Products

Yifan Yf325