Harden, Kawhi Leonard, Paul George and Russell Westbrook all have Southern California origins.
October 2023
EMERGENCY PODCAST: James Harden traded to the Clippers | Good Word with Goodwill
Vincent Goodwill sits down with Jake Fischer to react to the news of a blockbuster trade that sends James Harden from the Philadelphia 76ers to the Los Angeles Clippers.
Matt Petgrave ‘absolutely intended’ clash with Adam Johnson in ice hockey death, says ex-NHL star
The ice hockey player whose stray kick slashed an opponent’s throat was making an “unorthodox move” and “absolutely” trying to make contact, a former National Hockey League player has claimed.
EVs Were Supposed to Be the Answer. Now They’re the Problem.
Billionaire investor Stanley Druckenmiller accuses Janet Yellen of making the ‘biggest blunder in Treasury history’
Zavio IP Camera
1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Zavio
- Equipment: IP Camera
- Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer, OS Command Injection
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow remote code execution.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following versions of Zavio IP Cameras are affected:
- CF7500: version M2.1.6.05
- CF7300: version M2.1.6.05
- CF7201: version M2.1.6.05
- CF7501: version M2.1.6.05
- CB3211: version M2.1.6.05
- CB3212: version M2.1.6.05
- CB5220: version M2.1.6.05
- CB6231: version M2.1.6.05
- B8520: version M2.1.6.05
- B8220: version M2.1.6.05
- CD321: version M2.1.6.05
3.2 Vulnerability Overview
3.2.1 Stack-based Buffer Overflow CWE-121
Zavio IP Cameras CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, CD321 with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. While processing XML elements from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.
CVE-2023-3959 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
3.2.2 Stack-based Buffer Overflow CWE-121
Zavio IP Cameras CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, CD321 with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. While parsing certain XML elements from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.
CVE-2023-45225 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
3.2.3 Stack-based Buffer Overflow CWE-121
Zavio IP Cameras CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, CD321 with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. During the processing and parsing of certain fields in XML elements from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.
CVE-2023-43755 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
3.2.4 Stack-based Buffer Overflow CWE-121
Zavio IP Cameras CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, CD321 with firmware version M2.1.6.05 are vulnerable to stack-based overflows. During the process of updating certain settings sent from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.
CVE-2023-39435 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
3.2.5 Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) CWE-78
Zavio IP Cameras CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, CD321 with firmware version M2.1.6.05 has a command injection vulnerability in their implementation of their binaries and handling of network requests.
CVE-2023-4249 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
3.3 BACKGROUND
- CRITICAL INFRASTRUCTURE SECTORS: Multiple
- COUNTRIES/AREAS DEPLOYED: Worldwide
- COMPANY HEADQUARTERS LOCATION: Taiwan
3.4 RESEARCHER
Attila Szasz of BugProve reported these vulnerabilities to CISA. Mike Haldas of CCTV Camera Pros assisted in the coordination of these vulnerabilities with CISA.
4. MITIGATIONS
The affected products are end-of-life and have been identified to contain many insecurities. The vendor, Zavio, is no longer actively in business and therefore development for firmware fixes, mitigations, and updates are not available and will not become available. CISA recommends users discontinue use of the product.
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:
- Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
- Locate control system networks and remote devices behind firewalls and isolating them from business networks.
- When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
5. UPDATE HISTORY
- October 31, 2023: Initial Publication
This Is the Right Way to Store Firewood
Cold weather is coming, which means it’s time to light up your fireplace or firepit and build up your woodpile for the season. Whether you’re chopping firewood yourself or buying it and bringing it home, make sure you’re storing it correctly—don’t just dump it on the ground.
World Series Game 3: Christian Walker’s baserunning miscue leaves Diamondbacks on the wrong side of pivotal momentum shift
Walker ran through the stop sign and Arizona’s best chance to score. In the next frame, the Rangers took a lead they wouldn’t surrender, going up 2-1 in the series.
World Series 2023: Max Scherzer’s exit from Game 3 due to ‘back tightness’ leaves Rangers facing questions for the remainder of the series
The veteran was replaced by Jon Gray, who pitched three scoreless innings in Texas’ 3-1 victory Monday.
Connor Bedard just broke an all-time NHL record with his latest goal
Connor Bedard’s fourth goal of the season turned out to be a record-setting one Monday night in Arizona.