10 zero-day vulnerabilities in industrial cell router could lead to code execution, buffer overflows
Summary: Cisco Talos disclosed 11 vulnerabilities, 10 of them unpatched zero-days in the Yifan YF325 industrial cellular router, including TALOS-2023-1762 (CVE-2023-24479) at CVSS 9.8, which lets an attacker change admin credentials and gain root access. The set also includes TALOS-2023-1767 (CVE-2023-32632) for arbitrary shell command execution, TALOS-2023-1752 (CVE-2023-32645) for admin login via leftover debug credentials, and buffer overflow flaws triggered by crafted network requests, all rated 9.8.
What you should know: Talos published these 10 zero-days with no official patch from Yifan, and the vendor's own site lists the YF325 in smart grid, industrial automation, water supply and POS deployments - so the devices sit in environments where an unpatched root-level flaw is not an abstract risk.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-24479CVE-2023-32632CVE-2023-32645CVE-2023-39928
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026