CVE-2020-28592CWE-120

A heap-based buffer overflow vulnerability exists in the configuration server functionality of the Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0

High · published April 15, 2021

CVSS v3.0
8.1
EPSS
3%
Percentile
84.9
In the wild
Unconfirmed
What it is

🚨 A simple JSON packet can turn your air fryer into a hacker's playground! This heap-based buffer overflow lurking in the Cosori Smart Air Fryer makes it way too easy to execute remote code. 🔥 Think of it like a recipe book that includes a misprint — one wrong ingredient could lead to a disaster in the kitchen. Here, a carefully crafted command can trigger the air fryer to run unauthorized code, potentially causing chaos! An attacker could send a malicious JSON object and take control of the air fryer's functions. This means they could execute any code remotely, leading to unauthorized access and possibly even harmful actions that could compromise your kitchen safety! Absolutely devastating!

Put simply

Think of it like a recipe book that includes a misprint — one wrong ingredient could lead to a disaster in the kitchen. Here, a carefully crafted command can trigger the air fryer to run unauthorized code, potentially causing chaos! This heap-based buffer overflow vulnerability in the Cosori Smart Air Fryer's configuration server allows attackers to send a specially crafted JSON object that exploits the buffer limits, enabling remote code execution.

What to do

An attacker could send a malicious JSON object and take control of the air fryer's functions. This means they could execute any code remotely, leading to unauthorized access and possibly even harmful actions that could compromise your kitchen safety! Absolutely devastating! To protect yourself, update your air fryer firmware to the latest version, which addresses this vulnerability. Always monitor your device's settings and disable any unnecessary remote access features. Remember to conduct regular checks for updates! You've got this! Take these steps, and your kitchen will be secure in no time! 🛡️

The record
Technical detail
CVSS v3.0
8.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02545 · 84.9th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2021-04-15T13:40Z
EPSS history
Timeline
  • 15 APR 13:40Z
    A heap-based buffer overflow vulnerability exists in the configuration server functionality of the Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0
    cvelistv5