CVE-2014-2364CWE-121

Advantech WebAccess Stack-Based Buffer Overflow

High · published July 19, 2014

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 99.2th percentile for exploit probability.

CVSS v2.0

7.5

EPSS

61%

Percentile

99.2

In the wild

Unconfirmed

What it is

Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx.

The record

Technical detail

CVSS v2.0: 7.5 · HIGH
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v4.0: Not supplied
EPSS: 0.61384 · 99.2th percentile
Weakness: CWE-121 · Stack-based Buffer Overflow
Published: 2014-07-19T01:00Z

EPSS history

Timeline

19 JUL 01:00Z
Advantech WebAccess Stack-Based Buffer Overflow
cvelistv5