GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2022-2471

Vulnerability from fkie_nvd - Published: 2022-09-15 14:15 - Updated: 2026-06-17 04:41
Severity
9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Stack-based Buffer Overflow vulnerability in the EZVIZ Motion Detection component as used in camera models CS-CV248, CS-C6N-A0-1C2WFR, CS-DB1C-A0-1E2W2FR, CS-C6N-B0-1G2WF, CS-C3W-A0-3H4WFRL allows a remote attacker to execute remote code on the device. This issue affects: EZVIZ CS-CV248 versions prior to 5.2.3 build 220725. EZVIZ CS-C6N-A0-1C2WFR versions prior to 5.3.0 build 220428. EZVIZ CS-DB1C-A0-1E2W2FR versions prior to 5.3.0 build 220802. EZVIZ CS-C6N-B0-1G2WF versions prior to 5.3.0 build 220712. EZVIZ CS-C3W-A0-3H4WFRL versions prior to 5.3.5 build 220723.
References
cve-requests@bitdefender.comhttps://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-ezviz-smart-camsThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-ezviz-smart-camsThird Party Advisory
Impacted products
Vendor Product Version
ezviz cs-c6n-a0-1c2wfr_firmware 5.3.0
ezviz cs-c6n-a0-1c2wfr -
ezviz cs-db1c-a0-1e2w2fr_firmware 5.3.0
ezviz cs-db1c-a0-1e2w2fr -
ezviz cs-c6n-b0-1g2wf_firmware 5.3.0
ezviz cs-c6n-b0-1g2wf -
ezviz cs-c3w-a0-3h4wfrl_firmware 5.3.5
ezviz cs-c3w-a0-3h4wfrl -
ezviz cs-cv248_firmware 5.2.1
ezviz cs-cv248 -
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "CS-CV248",
          "vendor": "EZVIZ",
          "versions": [
            {
              "lessThan": "5.2.3 build 220725",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "CS-C6N-A0-1C2WFR",
          "vendor": "EZVIZ",
          "versions": [
            {
              "lessThan": "5.3.0 build 220428",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "CS-DB1C-A0-1E2W2FR",
          "vendor": "EZVIZ",
          "versions": [
            {
              "lessThan": "5.3.0 build 220802",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "CS-C6N-B0-1G2WF",
          "vendor": "EZVIZ",
          "versions": [
            {
              "lessThan": "5.3.0 build 220712",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "CS-C3W-A0-3H4WFRL",
          "vendor": "EZVIZ",
          "versions": [
            {
              "lessThan": "5.3.5 build 220723",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "cve-requests@bitdefender.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ezviz:cs-c6n-a0-1c2wfr_firmware:5.3.0:build201719:*:*:*:*:*:*",
              "matchCriteriaId": "47C0BBC0-DADA-4E4B-BD6D-09859B290EFC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ezviz:cs-c6n-a0-1c2wfr:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5F7B9244-BE9E-4F6F-99E3-A08B46C4559E",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ezviz:cs-db1c-a0-1e2w2fr_firmware:5.3.0:build211208:*:*:*:*:*:*",
              "matchCriteriaId": "C18E7920-0F8F-4C00-A649-69FD9FDFAF33",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ezviz:cs-db1c-a0-1e2w2fr:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA3AD5A7-8DDE-4750-AF0B-54FD9620D2AB",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ezviz:cs-c6n-b0-1g2wf_firmware:5.3.0:build210731:*:*:*:*:*:*",
              "matchCriteriaId": "14FFD3A3-5A67-4828-AE11-2747493BE4D7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ezviz:cs-c6n-b0-1g2wf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "53448693-4C67-4538-B879-12F3F8B51BEC",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ezviz:cs-c3w-a0-3h4wfrl_firmware:5.3.5:build220120:*:*:*:*:*:*",
              "matchCriteriaId": "6908D459-9F6A-44A0-BD35-CF61C0827EEF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ezviz:cs-c3w-a0-3h4wfrl:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "457F05D1-02C5-461A-93E3-E1D150BD60D4",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ezviz:cs-cv248_firmware:5.2.1:build180403:*:*:*:*:*:*",
              "matchCriteriaId": "54DA9047-AEB4-4C20-AC3D-9CA3B97C75C6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ezviz:cs-cv248:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE214B45-33B9-4C4D-AD19-0BB0DBC37ECD",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stack-based Buffer Overflow vulnerability in the EZVIZ Motion Detection component as used in camera models CS-CV248, CS-C6N-A0-1C2WFR, CS-DB1C-A0-1E2W2FR, CS-C6N-B0-1G2WF, CS-C3W-A0-3H4WFRL allows a remote attacker to execute remote code on the device. This issue affects: EZVIZ CS-CV248 versions prior to 5.2.3 build 220725. EZVIZ CS-C6N-A0-1C2WFR versions prior to 5.3.0 build 220428. EZVIZ CS-DB1C-A0-1E2W2FR versions prior to 5.3.0 build 220802. EZVIZ CS-C6N-B0-1G2WF versions prior to 5.3.0 build 220712. EZVIZ CS-C3W-A0-3H4WFRL versions prior to 5.3.5 build 220723."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Desbordamiento del B\u00fafer en la regi\u00f3n Stack de la Memoria en el componente de detecci\u00f3n de movimiento de EZVIZ usado en los modelos de c\u00e1mara CS-CV248, CS-C6N-A0-1C2WFR, CS-DB1C-A0-1E2W2FR, CS-C6N-B0-1G2WF, CS-C3W-A0-3H4WFRL permite a un atacante remoto ejecutar c\u00f3digo remoto en el dispositivo. Este problema afecta a: EZVIZ CS-CV248 versiones anteriores a 5.2.3 build 220725. EZVIZ CS-C6N-A0-1C2WFR versiones anteriores a 5.3.0 build 220428. EZVIZ CS-DB1C-A0-1E2W2FR versiones anteriores a 5.3.0 build 220802. EZVIZ CS-C6N-B0-1G2WF versiones anteriores a versi\u00f3n 5.3.0 build 220712. EZVIZ CS-C3W-A0-3H4WFRL versiones anteriores a 5.3.5 build 220723"
    }
  ],
  "id": "CVE-2022-2471",
  "lastModified": "2026-06-17T04:41:57.460",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "cve-requests@bitdefender.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-09-15T14:15:09.640",
  "references": [
    {
      "source": "cve-requests@bitdefender.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-ezviz-smart-cams"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-ezviz-smart-cams"
    }
  ],
  "sourceIdentifier": "cve-requests@bitdefender.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ],
      "source": "cve-requests@bitdefender.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.