CVE-2023-33218 | ByteOS Network

Vulnerability Details :

CVE-2023-33218

Assigner-IDEMIA

Assigner Org ID-a87f365f-9d39-4848-9b3a-58c7cae69cab

Published At-15 Dec, 2023 | 11:31

Updated At-02 Aug, 2024 | 15:39

Stack Buffer Overflow in a binary run at upgrade startup

The Parameter Zone Read and Parameter Zone Write command handlers allow performing a Stack buffer overflow. This could potentially lead to a Remote Code execution on the targeted device.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:IDEMIA

Assigner Org ID:a87f365f-9d39-4848-9b3a-58c7cae69cab

Published At:15 Dec, 2023 | 11:31

Updated At:02 Aug, 2024 | 15:39

▼CVE Numbering Authority (CNA)

Stack Buffer Overflow in a binary run at upgrade startup

The Parameter Zone Read and Parameter Zone Write command handlers allow performing a Stack buffer overflow. This could potentially lead to a Remote Code execution on the targeted device.

Affected Products

Vendor

Product

SIGMA Lite & Lite +

Default Status

unaffected

Versions

Affected

From 0 before 4.15.5 (custom)

Vendor

Product

Default Status

unaffected

Versions

Affected

From 0 before 4.15.5 (custom)

Vendor

Product

Default Status

unaffected

Versions

Affected

From 0 before 4.15.5 (custom)

Vendor

Product

MorphoWave Compact/XP

Default Status

unaffected

Versions

Affected

From 0 before 2.12.2 (custom)

Vendor

Product

Default Status

unaffected

Versions

Affected

From 0 before 2.12.2 (custom)

Vendor

Product

Default Status

unaffected

Versions

Affected

From 0 before 1.2.7 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-121	CWE-121 Stack-based Buffer Overflow

Type: CWE

CWE ID: CWE-121

Description: CWE-121 Stack-based Buffer Overflow

Metrics

Version	Base score	Base severity	Vector
3.1	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Version: 3.1

Base score: 9.1

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Impacts

CAPEC ID	Description
CAPEC-100	CAPEC-100 Overflow Buffers

CAPEC ID: CAPEC-100

Description: CAPEC-100 Overflow Buffers

References

Hyperlink	Resource
https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf	N/A

Hyperlink: https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf

Resource: N/A

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf	x_transferred

Hyperlink: https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf

Resource:

x_transferred

▼National Vulnerability Database (NVD)

Source:a87f365f-9d39-4848-9b3a-58c7cae69cab

Published At:15 Dec, 2023 | 12:15

Updated At:21 Dec, 2023 | 19:16

The Parameter Zone Read and Parameter Zone Write command handlers allow performing a Stack buffer overflow. This could potentially lead to a Remote Code execution on the targeted device.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 9.1

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CPE Matches

idemia>>sigma_lite_firmware>>Versions before 4.15.5(exclusive)

cpe:2.3:o:idemia:sigma_lite_firmware:*:*:*:*:*:*:*:*

idemia>>sigma_lite>>-

cpe:2.3:h:idemia:sigma_lite:-:*:*:*:*:*:*:*

idemia>>sigma_lite\+_firmware>>Versions before 4.15.5(exclusive)

cpe:2.3:o:idemia:sigma_lite\+_firmware:*:*:*:*:*:*:*:*

idemia>>sigma_lite\+>>-

cpe:2.3:h:idemia:sigma_lite\+:-:*:*:*:*:*:*:*

idemia>>sigma_extreme_firmware>>Versions before 4.15.5(exclusive)

cpe:2.3:o:idemia:sigma_extreme_firmware:*:*:*:*:*:*:*:*

idemia>>sigma_extreme>>-

cpe:2.3:h:idemia:sigma_extreme:-:*:*:*:*:*:*:*

idemia>>sigma_wide_firmware>>Versions before 4.15.5(exclusive)

cpe:2.3:o:idemia:sigma_wide_firmware:*:*:*:*:*:*:*:*

idemia>>sigma_wide>>-

cpe:2.3:h:idemia:sigma_wide:-:*:*:*:*:*:*:*

idemia>>morphowave_compact_firmware>>Versions before 2.12.2(exclusive)

cpe:2.3:o:idemia:morphowave_compact_firmware:*:*:*:*:*:*:*:*

idemia>>morphowave_compact>>-

cpe:2.3:h:idemia:morphowave_compact:-:*:*:*:*:*:*:*

idemia>>morphowave_xp_firmware>>Versions before 2.12.2(exclusive)

cpe:2.3:o:idemia:morphowave_xp_firmware:*:*:*:*:*:*:*:*

idemia>>morphowave_xp>>-

cpe:2.3:h:idemia:morphowave_xp:-:*:*:*:*:*:*:*

idemia>>visionpass_firmware>>Versions before 2.12.2(exclusive)

cpe:2.3:o:idemia:visionpass_firmware:*:*:*:*:*:*:*:*

idemia>>visionpass>>-

cpe:2.3:h:idemia:visionpass:-:*:*:*:*:*:*:*

idemia>>morphowave_sp_firmware>>Versions before 1.2.7(exclusive)

cpe:2.3:o:idemia:morphowave_sp_firmware:*:*:*:*:*:*:*:*

idemia>>morphowave_sp>>-

cpe:2.3:h:idemia:morphowave_sp:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-787	Primary	nvd@nist.gov
CWE-121	Secondary	a87f365f-9d39-4848-9b3a-58c7cae69cab

CWE ID: CWE-787

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-121

Type: Secondary

Source: a87f365f-9d39-4848-9b3a-58c7cae69cab

References

Hyperlink	Source	Resource
https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf	a87f365f-9d39-4848-9b3a-58c7cae69cab	Vendor Advisory

Hyperlink: https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf

Source: a87f365f-9d39-4848-9b3a-58c7cae69cab

Resource:

Vendor Advisory