CVE-2023-45591

A CWE-122 “Heap-based Buffer Overflow” vulnerability in the “logger_generic” function of the “Ax_rtu” binary allows a remote authenticated attacker to trigger a memory corruption in the context of the binary. This may result in a Denial-of-Service (DoS) condition, possibly in the execution of arbitrary code with the same privileges of the process (root), or have other unspecified impacts on the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45591	Third Party Advisory
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45591	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ailux:imx6:*:*:*:*:*:*:*:*

History

10 Apr 2025, 20:35

Type	Values Removed	Values Added
First Time		Ailux Ailux imx6
CPE		cpe:2.3:a:ailux:imx6::::::::
References	~~() https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45591 -~~	() https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45591 - Third Party Advisory
CWE		CWE-787

21 Nov 2024, 08:27

Type	Values Removed	Values Added
References	~~() https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45591 -~~	() https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45591 -

05 Mar 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-03-05 12:15

Updated : 2025-04-10 20:35

NVD link : CVE-2023-45591

Mitre link : CVE-2023-45591

CVE.ORG link : CVE-2023-45591

JSON object : View

Products Affected

ailux

imx6

CWE

CWE-122

Heap-based Buffer Overflow

CWE-787

Out-of-bounds Write

{"id": "CVE-2023-45591", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "prodsec@nozominetworks.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-03-05T12:15:45.833", "references": [{"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45591", "tags": ["Third Party Advisory"], "source": "prodsec@nozominetworks.com"}, {"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45591", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "prodsec@nozominetworks.com", "description": [{"lang": "en", "value": "CWE-122"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A CWE-122 \u201cHeap-based Buffer Overflow\u201d vulnerability in the \u201clogger_generic\u201d function of the \u201cAx_rtu\u201d binary allows a remote authenticated attacker to trigger a memory corruption in the context of the binary. This may result in a Denial-of-Service (DoS) condition, possibly in the execution of arbitrary code with the same privileges of the process (root), or have other unspecified impacts on the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2."}, {"lang": "es", "value": "Una vulnerabilidad CWE-122 de \u201cdesbordamiento de b\u00fafer de almacenamiento din\u00e1mico\u201d en la funci\u00f3n \u201clogger_generic\u201d del binario \u201cAx_rtu\u201d permite que un atacante remoto autenticado desencadene una corrupci\u00f3n de memoria en el contexto del binario. Esto puede resultar en una condici\u00f3n de Denegaci\u00f3n de Servicio (DoS), posiblemente en la ejecuci\u00f3n de c\u00f3digo arbitrario con los mismos privilegios del proceso (ra\u00edz), o tener otros impactos no especificados en el dispositivo. Este problema afecta: Paquete AiLux imx6 inferior a la versi\u00f3n imx6_1.0.7-2."}], "lastModified": "2025-04-10T20:35:32.530", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ailux:imx6:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AC8BA0D-1588-4072-8BEA-464B1E76AF80", "versionEndExcluding": "1.0.7-2"}], "operator": "OR"}]}], "sourceIdentifier": "prodsec@nozominetworks.com"}