Skip to content
Fencer Vulns
high 8.0

CVE-2023-34551 json

In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ SDK command server can allow an authenti…

published 2023-08-01 3 y ago modified 2026-07-09 4 mo ago also EUVD-2023-38606

cvss
8.0
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ SDK command server can allow an authenticated attacker present on the same local network as the camera to achieve remote code execution. This affects CS-C6N-B0-1G2WF Firmware versions before V5.3.0 build 230215 and CS-C6N-R101-1G2WF Firmware versions before V5.3.0 build 230215 and CS-CV310-A0-1B2WFR Firmware versions before V5.3.0 build 230221 and CS-CV310-A0-1C2WFR-C Firmware versions before V5.3.2 build 230221 and CS-C6N-A0-1C2WFR-MUL Firmware versions before V5.3.2 build 230218 and CS-CV310-A0-3C2WFRL-1080p Firmware versions before V5.2.7 build 230302 and CS-CV310-A0-1C2WFR Wifi IP66 2.8mm 1080p Firmware versions before V5.3.2 build 230214 and CS-CV248-A0-32WMFR Firmware versions before V5.2.3 build 230217 and EZVIZ LC1C Firmware versions before V5.3.4 build 230214. The impact is: execute arbitrary code (remote).

Patch / fix

  • ezviz cs-c6n-b0-1g2wf_firmware 5.3.0
  • ezviz cs-c6n-r101-1g2wf_firmware 5.3.0
  • ezviz cs-cv310-a0-1b2wfr_firmware 5.3.0
  • ezviz cs-cv310-a0-1c2wfr-c_firmware 5.3.2
  • ezviz cs-c6n-a0-1c2wfr-mul_firmware 5.3.2
  • ezviz cs-cv310-a0-3c2wfrl-1080p_firmware 5.2.7
  • ezviz cs-cv310-a0-1c2wfr 5.3.2
  • ezviz cs-cv248-a0-32wmfr_firmware 5.2.3
  • ezviz lc1c_firmware 5.3.4

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.0 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • ezviz cs-c6n-b0-1g2wf_firmware
  • ezviz cs-c6n-r101-1g2wf_firmware
  • ezviz cs-cv310-a0-1b2wfr_firmware
  • ezviz cs-cv310-a0-1c2wfr-c_firmware
  • ezviz cs-c6n-a0-1c2wfr-mul_firmware
  • ezviz cs-cv310-a0-3c2wfrl-1080p_firmware
  • ezviz cs-cv310-a0-1c2wfr
  • ezviz cs-cv248-a0-32wmfr_firmware
  • ezviz lc1c_firmware

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.