CVE-2023-24294
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
A buffer overflow vulnerability was discovered in Zumtobel Netlink CCD Onboard firmware version 3.80 in the NetlinkWeb::Information::SetDeviceIdentification component. This flaw could allow an attacker to execute arbitrary code or cause a denial of service.
Risk Assessment
The risk to the organization includes potential takeover of the network device, leading to compromise of lighting system integrity and availability, as well as possible access to the internal network.
Recommendation
It is recommended to immediately update the firmware to the latest available version and restrict management interface access to trusted networks only.
Other vulnerabilities in Zumtobel Netlink CCD Onboard
See all- CVE-2023-23325Critical
A command injection vulnerability was discovered in Zumtobel Netlink CCD Onboard firmware versions 3.74-3.80 via the NetHostname parameter. An attacker can remotely execute arbitrary system commands.
- CVE-2023-23324Critical
Hardcoded credentials for the Administrator account were discovered in Zumtobel Netlink CCD Onboard firmware versions 3.74-3.80.
Original NVD description (English source)
Zumtobel Netlink CCD Onboard v3.74 - Firmware v3.80 was discovered to contain a buffer overflow via the component NetlinkWeb::Information::SetDeviceIdentification.