CVE-2023-35968

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Two heap-based buffer overflow vulnerabilities exist in the gwcfg_cgi_set_manage_post_data functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to a heap buffer overflow. An attacker can send a network request to trigger these vulnerabilities.This integer overflow result is used as argument for the realloc function.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Oct 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-359697.8Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chain_table parsing functionality of GTKWave 3.3.115. CVE-2023-35975.0A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This fl CVE-2023-359707.8Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chain_table parsing functionality of GTKWave 3.3.115. CVE-2023-359716.1A vulnerability in the ArubaOS web-based management interface could allow an unauthenticated remote attacker to conduct a stored cross-site CVE-2023-359727.2An authenticated remote command injection vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of thi CVE-2023-359737.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitie CVE-2023-359747.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitie CVE-2023-359758.1An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability re CVE-2023-359766.5Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successfu CVE-2023-359776.5Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successfu CVE-2023-359786.1A vulnerability in ArubaOS could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a CVE-2023-359797.5There is an unauthenticated buffer overflow vulnerability in the process controlling the ArubaOS web-based management interface. Successful