Read the docs
TI-2023-17313 Aliases CVE-2023-34551GHSA-xg9r-w6fx-9996

In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of…

Priority LOW 37CWE-787Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ SDK command server can allow an authenticated attacker present on the same local network as the camera to achieve remote code execution. This affects CS-C6N-B0-1G2WF Firmware versions before V5.3.0 build 230215 and CS-C6N-R101-1G2WF Firmware versions before V5.3.0 build 230215 and CS-CV310-A0-1B2WFR Firmware versions before V5.3.0 build 230221 and CS-CV310-A0-1C2WFR-C Firmware versions before V5.3.2 build 230221 and CS-C6N-A0-1C2WFR-MUL Firmware versions before V5.3.2 build 230218 and CS-CV310-A0-3C2WFRL-1080p Firmware versions before V5.2.7 build 230302 and CS-CV310-A0-1C2WFR Wifi IP66 2.8mm 1080p Firmware versions before V5.3.2 build 230214 and CS-CV248-A0-32WMFR Firmware versions before V5.2.3 build 230217 and EZVIZ LC1C Firmware versions before V5.3.4 build 230214. The impact is: execute arbitrary code (remote).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00524 44th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:o:ezviz:cs-c6n-b0-1g2wf_firmware:*:*:*:*:*:*:*:*up to 5.3.0VulnerableEZVIZ
cpe:2.3:h:ezviz:cs-c6n-b0-1g2wf:-:*:*:*:*:*:*:*not specified by NVDRunning onEZVIZ
cpe:2.3:o:ezviz:cs-c6n-r101-1g2wf_firmware:*:*:*:*:*:*:*:*up to 5.3.0VulnerableEZVIZ
cpe:2.3:h:ezviz:cs-c6n-r101-1g2wf:-:*:*:*:*:*:*:*not specified by NVDRunning onEZVIZ
cpe:2.3:o:ezviz:cs-cv310-a0-1b2wfr_firmware:*:*:*:*:*:*:*:*up to 5.3.0VulnerableEZVIZ
cpe:2.3:h:ezviz:cs-cv310-a0-1b2wfr:-:*:*:*:*:*:*:*not specified by NVDRunning onEZVIZ
cpe:2.3:o:ezviz:cs-cv310-a0-1c2wfr-c_firmware:*:*:*:*:*:*:*:*up to 5.3.2VulnerableEZVIZ
cpe:2.3:h:ezviz:cs-cv310-a0-1c2wfr-c:-:*:*:*:*:*:*:*not specified by NVDRunning onEZVIZ
cpe:2.3:o:ezviz:cs-c6n-a0-1c2wfr-mul_firmware:*:*:*:*:*:*:*:*up to 5.3.2VulnerableEZVIZ
cpe:2.3:h:ezviz:cs-c6n-a0-1c2wfr-mul:-:*:*:*:*:*:*:*not specified by NVDRunning onEZVIZ
  • cpe:2.3:o:ezviz:cs-c6n-b0-1g2wf_firmware:*:*:*:*:*:*:*:* Versions up to 5.3.0 Vulnerable ·EZVIZ
  • cpe:2.3:h:ezviz:cs-c6n-b0-1g2wf:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EZVIZ
  • cpe:2.3:o:ezviz:cs-c6n-r101-1g2wf_firmware:*:*:*:*:*:*:*:* Versions up to 5.3.0 Vulnerable ·EZVIZ
  • cpe:2.3:h:ezviz:cs-c6n-r101-1g2wf:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EZVIZ
  • cpe:2.3:o:ezviz:cs-cv310-a0-1b2wfr_firmware:*:*:*:*:*:*:*:* Versions up to 5.3.0 Vulnerable ·EZVIZ
  • cpe:2.3:h:ezviz:cs-cv310-a0-1b2wfr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EZVIZ
  • cpe:2.3:o:ezviz:cs-cv310-a0-1c2wfr-c_firmware:*:*:*:*:*:*:*:* Versions up to 5.3.2 Vulnerable ·EZVIZ
  • cpe:2.3:h:ezviz:cs-cv310-a0-1c2wfr-c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EZVIZ
  • cpe:2.3:o:ezviz:cs-c6n-a0-1c2wfr-mul_firmware:*:*:*:*:*:*:*:* Versions up to 5.3.2 Vulnerable ·EZVIZ
  • cpe:2.3:h:ezviz:cs-c6n-a0-1c2wfr-mul:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EZVIZ
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:ezviz:cs-cv310-a0-3c2wfrl-1080p_firmware:*:*:*:*:*:*:*:*up to 5.2.7VulnerableEZVIZ
cpe:2.3:h:ezviz:cs-cv310-a0-3c2wfrl-1080p:-:*:*:*:*:*:*:*not specified by NVDRunning onEZVIZ
cpe:2.3:o:ezviz:cs-cv310-a0-1c2wfr_firmware:*:*:*:*:*:*:*:*up to 5.3.2VulnerableEZVIZ
cpe:2.3:h:ezviz:cs-cv310-a0-1c2wfr:-:*:*:*:*:*:*:*not specified by NVDRunning onEZVIZ
cpe:2.3:o:ezviz:cs-cv248-a0-32wmfr_firmware:*:*:*:*:*:*:*:*up to 5.2.3VulnerableEZVIZ
cpe:2.3:h:ezviz:cs-cv248-a0-32wmfr:-:*:*:*:*:*:*:*not specified by NVDRunning onEZVIZ
cpe:2.3:o:ezviz:lc1c_firmware:*:*:*:*:*:*:*:*up to 5.3.4VulnerableEZVIZ
cpe:2.3:h:ezviz:lc1c:-:*:*:*:*:*:*:*not specified by NVDRunning onEZVIZ
  • cpe:2.3:o:ezviz:cs-cv310-a0-3c2wfrl-1080p_firmware:*:*:*:*:*:*:*:* Versions up to 5.2.7 Vulnerable ·EZVIZ
  • cpe:2.3:h:ezviz:cs-cv310-a0-3c2wfrl-1080p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EZVIZ
  • cpe:2.3:o:ezviz:cs-cv310-a0-1c2wfr_firmware:*:*:*:*:*:*:*:* Versions up to 5.3.2 Vulnerable ·EZVIZ
  • cpe:2.3:h:ezviz:cs-cv310-a0-1c2wfr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EZVIZ
  • cpe:2.3:o:ezviz:cs-cv248-a0-32wmfr_firmware:*:*:*:*:*:*:*:* Versions up to 5.2.3 Vulnerable ·EZVIZ
  • cpe:2.3:h:ezviz:cs-cv248-a0-32wmfr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EZVIZ
  • cpe:2.3:o:ezviz:lc1c_firmware:*:*:*:*:*:*:*:* Versions up to 5.3.4 Vulnerable ·EZVIZ
  • cpe:2.3:h:ezviz:lc1c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EZVIZ

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-34551
  2. 2026-10-03 Alias added: GHSA-xg9r-w6fx-9996

References

Advisory 1

  • TI-2023-17314 In certain EZVIZ products, two stack based buffer overflows in mulicast_parse_sadp_packet… CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences