PT-2014-4652 · Advantech · Advantech Webaccess
Publicado
2014-07-18
·
Atualizado
2025-10-06
·
CVE-2014-2364
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Advantech WebAccess versions prior to 7.2
Description
The issue is related to multiple stack-based buffer overflows in Advantech WebAccess. Remote attackers can execute arbitrary code via a long string in various parameters to ActiveX controls in webvact.ocx, dvs.ocx, or webdact.ocx, including
ProjectName, SetParameter, NodeName, CCDParameter, SetColor, AlarmImage, GetParameter, GetColor, ServerResponse, SetBaud, or IPAddress.Recommendations
For Advantech WebAccess versions prior to 7.2, update to version 7.2 or later to resolve the issue.
As a temporary workaround, consider restricting access to the vulnerable ActiveX controls
webvact.ocx, dvs.ocx, and webdact.ocx until a patch is applied.
Avoid using the parameters ProjectName, SetParameter, NodeName, CCDParameter, SetColor, AlarmImage, GetParameter, GetColor, ServerResponse, SetBaud, and IPAddress in the affected ActiveX controls until the issue is resolved.Exploit
Correção
RCE
Buffer Overflow
Stack Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Advantech Webaccess