Zavio IP Camera Stack-Based Buffer Overflow
Priority HIGH 80CWE-121Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. While processing XML elements from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.48765 98th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Zavio | IP Camera CF7500 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera CF7300 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera CF7201 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera CF7501 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera CB3211 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera CB3212 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera CB5220 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera CB6231 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera B8520 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera B8220 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera CD321 | version M2.1.6.05 | — | No fix listed | CNA |
- IP Camera CF7500 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera CF7300 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera CF7201 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera CF7501 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera CB3211 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera CB3212 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera CB5220 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera CB6231 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera B8520 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera B8220 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera CD321 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
CPE configurations NVD · 22
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:zavio:cf7500_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cf7500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:cf7300_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cf7300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:cf7201_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cf7201:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:cf7501_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cf7501:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:cb3211_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cb3211:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
- cpe:2.3:o:zavio:cf7500_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cf7500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:cf7300_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cf7300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:cf7201_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cf7201:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:cf7501_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cf7501:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:cb3211_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cb3211:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
Show 12 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:zavio:cb3212_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cb3212:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:cb5220_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cb5220:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:cb6231_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cb6231:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:b8520_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:b8520:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:b8220_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:b8220:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:cd321_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cd321:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
- cpe:2.3:o:zavio:cb3212_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cb3212:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:cb5220_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cb5220:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:cb6231_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cb6231:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:b8520_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:b8520:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:b8220_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:b8220:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:cd321_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cd321:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-3959
- 2026-10-03 Alias added: GHSA-xw58-crph-crhm
References
More Zavio B8220 Firmware vulnerabilities
- TI-2023-03935 Zavio IP Camera Stack-Based Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2023-24230 Zavio IP Camera Stack-Based Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2023-23455 Zavio IP Camera Stack-Based Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2023-20571 Zavio IP Camera Stack-Based Buffer Overflow CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-3959 · CVE Program
- CVE-2023-3959 · NVD
- FIRST EPSS
- GHSA-xw58-crph-crhm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences