CVE-2014-1201 Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with firmware 11.17.38-33_1D97A, and Edge3 LH340 series....
HighCVSS 10.0
EPSS 29.5%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with firmware 11.17.38-33_1D97A, and Edge3 LH340 series with firmware 11.19.85_1FE3A allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the HTTP_PORT parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lorex technology edge lh310 firmware | = 7-35-28-1b26e | No fix listed |
| lorextechnology edge | = lh310 | No fix listed |
| lorex technology edge3 lh340 firmware | = 11.19.85_1fe3a | No fix listed |
| lorextechnology edge3 | = lh340 | No fix listed |
| lorex technology edge2 lh330 firmware | = 11.17.38-33_1d97a | No fix listed |
| lorextechnology edge2 | = lh330 | No fix listed |
| lorex technology edge+ lh320 firmware | = 7-35-28-1b26e | No fix listed |
| lorextechnology edge+ | = lh320 | No fix listed |
References
- 101903 vdb-entry
- 20140110 [CVE -2014-1201] Lorex security DVR ActiveX control buffer overflow mailing-list
- lorex-cve20141201-bo(90223) vdb-entry
- github.com
- github.com