CVE-2023-45591

{"id": "CVE-2023-45591", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "prodsec@nozominetworks.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-03-05T12:15:45.833", "references": [{"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45591", "tags": ["Third Party Advisory"], "source": "prodsec@nozominetworks.com"}, {"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45591", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "prodsec@nozominetworks.com", "description": [{"lang": "en", "value": "CWE-122"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A CWE-122 \u201cHeap-based Buffer Overflow\u201d vulnerability in the \u201clogger_generic\u201d function of the \u201cAx_rtu\u201d binary allows a remote authenticated attacker to trigger a memory corruption in the context of the binary. This may result in a Denial-of-Service (DoS) condition, possibly in the execution of arbitrary code with the same privileges of the process (root), or have other unspecified impacts on the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2."}, {"lang": "es", "value": "Una vulnerabilidad CWE-122 de \u201cdesbordamiento de b\u00fafer de almacenamiento din\u00e1mico\u201d en la funci\u00f3n \u201clogger_generic\u201d del binario \u201cAx_rtu\u201d permite que un atacante remoto autenticado desencadene una corrupci\u00f3n de memoria en el contexto del binario. Esto puede resultar en una condici\u00f3n de Denegaci\u00f3n de Servicio (DoS), posiblemente en la ejecuci\u00f3n de c\u00f3digo arbitrario con los mismos privilegios del proceso (ra\u00edz), o tener otros impactos no especificados en el dispositivo. Este problema afecta: Paquete AiLux imx6 inferior a la versi\u00f3n imx6_1.0.7-2."}], "lastModified": "2025-04-10T20:35:32.530", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ailux:imx6:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AC8BA0D-1588-4072-8BEA-464B1E76AF80", "versionEndExcluding": "1.0.7-2"}], "operator": "OR"}]}], "sourceIdentifier": "prodsec@nozominetworks.com"}