O Kam Client
Monthly
A stack-based buffer overflow (CWE-121) exists in the Windows client software VStarcam O-KAM Client 1.3.3.32, specifically inside the exported/imported function FUN_10003EA0 of the native library DevDll_925.dll. The vendor was contacted but did not respond and no vendor-released patch has been identified at time of analysis; the affected version is the only one confirmed in the CPE data (cpe:2.3:a:vstarcam:o-kam_client), so exposure is limited to users running that build. The issue is remotely reachable according to the CVSS 4.0 vector (AV:N/PR:N/UI:N, score 6.9; our assessed CVSS 3.1 vector scores it 6.5 with Low confidentiality, integrity and availability impact), and a public PoC reference exists in a GitHub gist; it is not verified as working exploit code and there is no CISA KEV confirmation of active exploitation. The exact feature, protocol, or code path that delivers attacker-controlled data into FUN_10003EA0 is not described in the available sources.
A stack-based buffer overflow (CWE-121) exists in the Windows client software VStarcam O-KAM Client 1.3.3.32, specifically inside the exported/imported function FUN_10003EA0 of the native library DevDll_925.dll. The vendor was contacted but did not respond and no vendor-released patch has been identified at time of analysis; the affected version is the only one confirmed in the CPE data (cpe:2.3:a:vstarcam:o-kam_client), so exposure is limited to users running that build. The issue is remotely reachable according to the CVSS 4.0 vector (AV:N/PR:N/UI:N, score 6.9; our assessed CVSS 3.1 vector scores it 6.5 with Low confidentiality, integrity and availability impact), and a public PoC reference exists in a GitHub gist; it is not verified as working exploit code and there is no CISA KEV confirmation of active exploitation. The exact feature, protocol, or code path that delivers attacker-controlled data into FUN_10003EA0 is not described in the available sources.