high7.5Public exploit code
CVE-2014-2364
Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectNa…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Advantech Webaccess - dvs.ocx GetColor Buffer Overflow (Metasploit)2014-09-24 · remote · windows · Verified
Impact
Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Advantech | Advantech Webaccess | through 7.1 Versions 5.0, 6.0, 7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/128384/Advantech-WebAccess-dvs.ocx-GetColor-Buffer-Overflow.html
- http://webaccess.advantech.com/
- http://www.securityfocus.com/bid/68714
- https://www.cisa.gov/news-events/ics-advisories/icsa-14-198-02
- http://ics-cert.us-cert.gov/advisories/ICSA-14-198-02
- http://packetstormsecurity.com/files/128384/Advantech-WebAccess-dvs.ocx-GetColor-Buffer-Overflow.html
- http://www.securityfocus.com/bid/68714