PT-2014-4652 · Advantech · Advantech Webaccess
Published
2014-07-18
·
Updated
2025-10-06
·
CVE-2014-2364
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Advantech WebAccess versions prior to 7.2
Description
The issue is related to multiple stack-based buffer overflows in Advantech WebAccess. Remote attackers can execute arbitrary code via a long string in various parameters to ActiveX controls in webvact.ocx, dvs.ocx, or webdact.ocx, including
ProjectName, SetParameter, NodeName, CCDParameter, SetColor, AlarmImage, GetParameter, GetColor, ServerResponse, SetBaud, or IPAddress.Recommendations
For Advantech WebAccess versions prior to 7.2, update to version 7.2 or later to resolve the issue.
As a temporary workaround, consider restricting access to the vulnerable ActiveX controls
webvact.ocx, dvs.ocx, and webdact.ocx until a patch is applied.
Avoid using the parameters ProjectName, SetParameter, NodeName, CCDParameter, SetColor, AlarmImage, GetParameter, GetColor, ServerResponse, SetBaud, and IPAddress in the affected ActiveX controls until the issue is resolved.Exploit
Fix
RCE
Buffer Overflow
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Advantech Webaccess