CVE-2023-35966

Summary

CVE-2023-35966 is a newly disclosed vulnerability in the Yifan YF325 v1.0_20221108 httpd manage_post functionality. This issue involves two heap-based buffer overflow vulnerabilities that can be triggered by a specially crafted network request. An attacker can exploit these vulnerabilities by sending an oversized request, leading to a heap buffer overflow. The integer overflow result is subsequently used as an argument for the realloc function, potentially allowing an attacker to execute arbitrary code or cause a denial-of-service condition.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.