CVE-2014-2364 Advantech WebAccess Stack-Based Buffer Overflow
HighCVSS 7.5
EPSS 61.4%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| advantech webaccess | <= 7.1 | No fix listed |
| advantech webaccess | = 5.0 | No fix listed |
| advantech webaccess | = 6.0 | No fix listed |
| advantech webaccess | = 7.0 | No fix listed |
References
- packetstormsecurity.com exploit
- webaccess.advantech.com
- 68714 exploit vdb-entry
- www.cisa.gov
- ics-cert.us-cert.gov third-party-advisory us-government-resource