CVE-2014-9263 Multiple buffer overflows in the PocketNetNVRMediaClientAxCtrl.NVRMediaViewer.1 control in 3S Pocketnet Tech VMS allow remote attackers to execute arbitrary code via a crafted string to the (1) StartR...

MediumCVSS 6.8 EPSS 3.8%

Published: 2014-12-08 18:00
Updated: 2026-06-17 03:18
Exploit status: No public exploit known

Description

Multiple buffer overflows in the PocketNetNVRMediaClientAxCtrl.NVRMediaViewer.1 control in 3S Pocketnet Tech VMS allow remote attackers to execute arbitrary code via a crafted string to the (1) StartRecord, (2) StartRecordEx, (3) StartScheduledRecord, (4) SetDisplayText, (5) GetONVIFDeviceInformation, (6) GetONVIFProfiles, or (7) GetONVIFStreamUri method or a crafted filename to the (8) SaveCurrentImage or (9) SaveCurrentImageEx method.

Affected products

Product	Affected versions	Fixed in
3s pocketnet tech video management software	All versions	No fix listed

References

CVSS v2.0

6.8 Medium

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Medium
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 3.81% (percentile 90.2)
CWE: CWE-119

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.