CVE-2014-2364CWE-121

CVE-2014-2364: vulnerability in Advantech WebAccess

Advantech WebAccess Stack-Based Buffer Overflow

Published · Updated

Follow this CVE+ Monitor WebAccess

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

68Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 7.5epss 61%
from disclosure to weapon67 days
Published on NVDJul 19
1st PoC+67d
metasploitJul 17
Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected products
Advantech · WebAccess
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Advantech WebAccess

In the same product, most dangerous first.

CVE-2014-0763—Advantech WebAccess SQL InjectionEPSS 15.6%CVE-2021-38389CRITICALAdvantech WebAccessEPSS 10.4%CVE-2018-8845—CVE-2018-8845EPSS 5.6%CVE-2019-3940—CVE-2019-3940EPSS 4.1%CVE-2018-10589—CVE-2018-10589EPSS 3.9%CVE-2018-7499—CVE-2018-7499EPSS 3.7%