CVE-2023-24294

Published: Nov 29, 2023Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Zumtobel Netlink CCD Onboard v3.74 - Firmware v3.80 was discovered to contain a buffer overflow via the component NetlinkWeb::Information::SetDeviceIdentification.

Affected (1)

Products: Zumtobel: Netlink Ccd Firmware

Zumtobel

1 product

Netlink Ccd Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zumtobel Netlink Ccd Firmware	Version 3.80

Running on/with	Platform Versions
Zumtobel Netlink Ccd	Version 3.74

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (4)

http://zumtobel.com

Source: cve@mitre.org

Product

https://yoroi.company/en/research/cve-advisory-partial-disclosure-zumtobel-multiple-vulnerabilities/

Source: cve@mitre.org

MitigationThird Party Advisory

http://zumtobel.com

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://yoroi.company/en/research/cve-advisory-partial-disclosure-zumtobel-multiple-vulnerabilities/

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party Advisory

Timeline

No history available yet.