CVE-2022-2471

moderate-risk
Published 2022-09-15

Stack-based Buffer Overflow vulnerability in the EZVIZ Motion Detection component as used in camera models CS-CV248, CS-C6N-A0-1C2WFR, CS-DB1C-A0-1E2W2FR, CS-C6N-B0-1G2WF, CS-C3W-A0-3H4WFRL allows a remote attacker to execute remote code on the device. This issue affects: EZVIZ CS-CV248 versions prior to 5.2.3 build 220725. EZVIZ CS-C6N-A0-1C2WFR versions prior to 5.3.0 build 220428. EZVIZ CS-DB1C-A0-1E2W2FR versions prior to 5.3.0 build 220802. EZVIZ CS-C6N-B0-1G2WF versions prior to 5.3.0 build 220712. EZVIZ CS-C3W-A0-3H4WFRL versions prior to 5.3.5 build 220723.

Do I need to act?

-
0.95% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.9/10 Critical
NETWORK / LOW complexity

Affected Products (5)

Cs-C6N-A0-1C2Wfr Firmware
Cs-Db1C-A0-1E2W2Fr Firmware
Cs-C6N-B0-1G2Wf Firmware
Cs-C3W-A0-3H4Wfrl Firmware
Cs-Cv248 Firmware

Affected Vendors

Ezviz

References (2)

Third Party Advisory https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-ezviz-smart-...
Third Party Advisory https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-ezviz-smart-...
48
/ 100
moderate-risk
Severity 33/34 · Critical
Exploitability 3/34 · Minimal
Exposure 12/34 · Low