ZDI-CAN-20971: ZDI-23-1861: oFono SMS Decoder Stack-based Buffer Overflow Remote Code Execution Vulnerability

Published Dec 20, 2023

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of oFono. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2023-2794.

Affected Software

1 affected component

oFono oFono

Event History

Dec 20, 2023

Advisory Published

06:00 AM

Data Sourced

06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-20971?

ZDI-CAN-20971 has been given a high severity rating by the ZDI due to its potential for remote code execution.

How do I fix ZDI-CAN-20971?

To fix ZDI-CAN-20971, update your oFono software to the latest version that patches this vulnerability.

What are the risks associated with ZDI-CAN-20971?

The risks of ZDI-CAN-20971 include unauthorized remote code execution and potential compromise of affected systems.

Who is affected by ZDI-CAN-20971?

ZDI-CAN-20971 affects all installations of oFono that are vulnerable to the stack-based buffer overflow.

Is authentication required to exploit ZDI-CAN-20971?

No, authentication is not required to exploit ZDI-CAN-20971, making it particularly dangerous.