← Vulnerability feed

Vulnerability record · CVE-2023-34346 · published 11 October 2023

CVE-2023-34346: Yifanwireless yf325 firmware out-of-bounds write vulnerability

Yifanwireless · Yf325 Firmware

A stack-based buffer overflow vulnerability exists in the httpd gwcfg.cgi get functionality of Yifan YF325 v1.0_20221108. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability.

9.8 CVSS 3.1 Critical EPSS 1.3% · top 30.9% CWE-489 · CWE-489CWE-787 · Out-of-bounds write
9.8CVSS 3.1 base score
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

A stack-based buffer overflow vulnerability exists in the httpd gwcfg.cgi get functionality of Yifan YF325 v1.0_20221108. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1764 Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1764 Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1764

Track CVE-2023-34346 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-35967Yifanwireless yf325 firmware integer overflow vulnerabilityTwo heap-based buffer overflow vulnerabilities exist in the gwcfg_cgi_set_manage_post_data functionality of Yifan YF325 v1.0_20221108. A specially cr…EPSS 0.77%9.8CVE-2023-35968Yifanwireless yf325 firmware integer overflow vulnerabilityTwo heap-based buffer overflow vulnerabilities exist in the gwcfg_cgi_set_manage_post_data functionality of Yifan YF325 v1.0_20221108. A specially cr…EPSS 0.77%9.8CVE-2023-32645Yifan YF325 httpd debug credentials authentication bypassThe Yifan YF325 firmware (v1.0_20221108) ships leftover debug credentials in the httpd component. A specially crafted network request can exploit thi…EPSS 54%analysed9.8CVE-2023-34365Yifanwireless yf325 firmware stack-based buffer overflow vulnerabilityA stack-based buffer overflow vulnerability exists in the libutils.so nvram_restore functionality of Yifan YF325 v1.0_20221108. A specially crafted n…EPSS 0.77%9.8CVE-2023-34426Yifanwireless yf325 firmware stack-based buffer overflow vulnerabilityA stack-based buffer overflow vulnerability exists in the httpd manage_request functionality of Yifan YF325 v1.0_20221108. A specially crafted networ…EPSS 0.77%9.8CVE-2023-35055Yifanwireless yf325 firmware stack-based buffer overflow vulnerabilityA buffer overflow vulnerability exists in the httpd next_page functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lea…EPSS 1.0%9.8CVE-2023-35056Yifanwireless yf325 firmware stack-based buffer overflow vulnerabilityA buffer overflow vulnerability exists in the httpd next_page functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lea…EPSS 1.0%9.8CVE-2023-35965Yifanwireless yf325 firmware integer overflow vulnerabilityTwo heap-based buffer overflow vulnerabilities exist in the httpd manage_post functionality of Yifan YF325 v1.0_20221108. A specially crafted network…EPSS 0.77%

Source: NIST National Vulnerability Database (record CVE-2023-34346), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.