CVE-2020-28592

PoC —

CVSS 3.1

9.8 critical

EPSS

3%p84

Published

Apr 15, 2021 (Apr 15, 2021)

Modified

Jun 17, 2026

Description

A heap-based buffer overflow vulnerability exists in the configuration server functionality of the Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially crafted JSON object can lead to remote code execution. An attacker can send a malicious packet to trigger this vulnerability.

Vendors: cosori
Products: cs158-af firmware
Weakness: CWE-120, CWE-787
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.5%)

In the news3 stories

Watch out, hackers can take over your Cosori Smart Air Fryer

Security AffairsApr 20, 13:33 UTC · Apr 20, 2021Vulnerability in the wildCVE-2020-28592 CVE-2020-28593

Vulnerability Spotlight: Remote code execution vulnerabilities in Cosori smart air fryer

Cisco TalosApr 19, 13:54 UTC · Apr 19, 2021Vulnerability in the wildCVE-2020-28592 CVE-2020-28593

Fighting the Rogue Toaster Army: Why Secure Coding in Embedded Systems is Our Defensive Edge

The Hacker NewsSep 9, 08:28 UTC · Sep 9, 2021Vulnerability CVE-2020-28592