Zavio IP Camera Stack-Based Buffer Overflow
Priority MEDIUM 57CWE-121Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 has a command injection vulnerability in their implementation of their binaries and handling of network requests.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.12943 96th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Zavio | IP Camera CF7500 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera CF7300 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera CF7201 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera CF7501 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera CB3211 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera CB3212 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera CB5220 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera CB6231 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera B8520 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera B8220 | version M2.1.6.05 | — | No fix listed | CNA |
| Zavio | IP Camera CD321 | version M2.1.6.05 | — | No fix listed | CNA |
- IP Camera CF7500 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera CF7300 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera CF7201 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera CF7501 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera CB3211 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera CB3212 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera CB5220 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera CB6231 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera B8520 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera B8220 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
- IP Camera CD321 VendorZavio Affected version M2.1.6.05 Fixed in — No fix listed CNA
CPE configurations NVD · 22
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:zavio:cf7500_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cf7500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:cf7300_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cf7300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:cf7201_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cf7201:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:cf7501_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cf7501:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:cb3211_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cb3211:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
- cpe:2.3:o:zavio:cf7500_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cf7500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:cf7300_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cf7300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:cf7201_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cf7201:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:cf7501_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cf7501:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:cb3211_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cb3211:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
Show 12 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:zavio:cb3212_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cb3212:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:cb5220_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cb5220:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:cb6231_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cb6231:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:b8520_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:b8520:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:b8220_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:b8220:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
| cpe:2.3:o:zavio:cd321_firmware:m2.1.6.05:*:*:*:*:*:*:* | m2.1.6.05 | Vulnerable | Zavio |
| cpe:2.3:h:zavio:cd321:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zavio |
- cpe:2.3:o:zavio:cb3212_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cb3212:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:cb5220_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cb5220:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:cb6231_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cb6231:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:b8520_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:b8520:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:b8220_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:b8220:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
- cpe:2.3:o:zavio:cd321_firmware:m2.1.6.05:*:*:*:*:*:*:* Versions m2.1.6.05 Vulnerable ·Zavio
- cpe:2.3:h:zavio:cd321:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zavio
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-4249
- 2026-10-03 Alias added: GHSA-hf79-fwx9-q3gm
References
More Zavio B8220 Firmware vulnerabilities
- TI-2023-03678 Zavio IP Camera Stack-Based Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2023-24230 Zavio IP Camera Stack-Based Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2023-23455 Zavio IP Camera Stack-Based Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2023-20571 Zavio IP Camera Stack-Based Buffer Overflow CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-4249 · CVE Program
- CVE-2023-4249 · NVD
- FIRST EPSS
- GHSA-hf79-fwx9-q3gm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences