CVE-2023-45591 is a high severity heap based buffer overflow in the logger_generic function of the Ax_rtu binary in the AiLux imx6 bundle, scored 7.5. Versions below imx6_1.0.7-2 are affected. Update to imx6_1.0.7-2 or later. The flaw needs a login and a complex attack, which keeps the score at 7.5.
What's affected
The NVD record lists the AiLux imx6 bundle below version imx6_1.0.7-2 as affected. Nozomi Networks' advisory for CVE-2023-45591, which I read, gives the fix as updating to imx6 bundle version imx6_1.0.7-2, and its mitigations section is empty. The record for this CVE uses the same version boundary.
This is one of six CVEs in the same bundle that share the version boundary and the fix. The related records in this range are CVE-2023-45591, CVE-2023-45592, CVE-2023-45595, CVE-2023-45597, CVE-2023-45599 and CVE-2023-45600.
How to check if you're exposed
AiLux imx6 is a bundle for networked camera and edge devices. The version appears in the device's web interface or in the vendor's firmware information. The exact location depends on the device, so use the vendor's documentation.
If you operate these devices, record the bundle version for each and compare it with imx6_1.0.7-2. Anything below that version is in scope. Devices that cannot be updated should be kept off untrusted networks, and the web interface should not be reachable from the internet.
What to do now
- Identify devices that run the AiLux imx6 bundle and note the bundle version of each.
- Update to imx6_1.0.7-2 or later, as the vendor advisory directs.
- Restrict access to the device web interface to a management network.
- Review web interface accounts and remove any that are not needed.
- Confirm the version after the update and keep the record.
Why it matters
The weakness is a heap based buffer overflow, CWE-122, also filed as an out of bounds write, CWE-787. A remote authenticated attacker can corrupt memory in the Ax_rtu binary. Per the record, the result could be a denial of service, execution of arbitrary code with the privileges of the process, which is root, or other unspecified effects.
The vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The attacker needs a login and the attack is complex, which holds the score at 7.5. Nozomi lists the impact as denial of service, possible disclosure of secrets, or, in the worst case, root remote code execution.
The CVE is not on the CISA Known Exploited Vulnerabilities list. Running a service as root raises the cost of any memory bug in it, a point that applies to CVE-2023-45592 in the same bundle.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Quick check
Does the attacker need to log in?
Yes. The record describes a remote authenticated attacker.
Is there a workaround?
Nozomi's advisory leaves the mitigations section empty and lists the update as the remedy.
Sources
Last reviewed: 19 October 2026.
