Notice Released By: EZVIZ Security Team

Initial Release Date: 2024/1/26

Vulnerability & Affected Versions: 

The EZVIZ Studio software (Windows) has been affected by a buffer overflow based Structured Exception Handler (SEH), which could be leveraged to execute arbitrary code with local administrator rights (CVE-2023-50613).

Scoring: 

CVSS v3.1 is adopted in this vulnerability scoring. (http://www.first.org/cvss/specification-document)

Base score: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

Fix Progress: 

The related vulnerability has been fixed and the updated version has been released on https://support.ezviz.com/download. Users with an affected version can completely fix the vulnerability by upgrading their EZVIZ Studio software.

Completing Upgrade:

The EZVIZ Studio will automatically detect the new version and upgrade accordingly, if it is permitted by the system settings selected by the user.
Users can also download the latest version from https://support.ezviz.com/download to complete the upgrade manually.

Source of Vulnerability Information:

The vulnerability was reported to EZVIZ Security Team by ethical hacker KARATEKIN Mickael (@sysdream.com)

Contact Us:

If you believe you have discovered a security vulnerability, please report it to EZVIZ at security@ezviz.com, or join our bounty program on YesWeHack. Our security team will be in touch if we need more information.

EZVIZ would like to thank all security researchers and professionals who help test, identify and mitigate potential vulnerabilities in EZVIZ products, ensuring that we continue to respectfully protect people and homes, while securing devices and data.