CVE-2023-35967 - CVE House
Back to Database
Status published Critical CVE-2023-35967

Two heap-based buffer overflow vulnerabilities exist in the gwcfg_cgi_set_manage_post_data functionality...

Vulnerability Description

Two heap-based buffer overflow vulnerabilities exist in the gwcfg_cgi_set_manage_post_data functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to a heap buffer overflow. An attacker can send a network request to trigger these vulnerabilities.This integer overflow result is used as argument for the malloc function.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-35967

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Discovered by Francesco Benvenuto of Cisco Talos.

References

More from Yifan

View All →
CVE-2023-35968
Two heap-based buffer overflow vulnerabilities exist in the gwcfg_cgi_set_manage_post_data functionality...
Critical 9.8
CVE-2023-35966
Two heap-based buffer overflow vulnerabilities exist in the httpd manage_post...
Critical 9.8
CVE-2023-35965
Two heap-based buffer overflow vulnerabilities exist in the httpd manage_post...
Critical 9.8
CVE-2023-35056
A buffer overflow vulnerability exists in the httpd next_page functionality...
High 8.8
CVE-2023-35055
A buffer overflow vulnerability exists in the httpd next_page functionality...
High 8.8

Affected Vendor

Affected Software

YF325
Vulnerable Versions:
v1.0_20221108

Timeline

Official Publish: October 11th, 2023
Last Modified: November 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-190

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control
T1499 Endpoint Denial of Service
Impact