PT-2015-5006 · Moxa · Moxa Vport Activex Sdk Plus

Ariele Caltabiano · Published 2015-05-26 · Updated 2016-12-08 · CVE-2015-0986

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Moxa VPort ActiveX SDK Plus versions prior to 2.8

Description The issue involves multiple stack-based buffer overflows that allow remote attackers to execute arbitrary code via specific vectors, including regkey set or get commands. This can be achieved by manipulating the GetClientReg Name Parameter.

Recommendations For versions prior to 2.8, update to version 2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the regkey set and get commands to minimize the risk of exploitation. Avoid using the GetClientReg Name Parameter in sensitive operations until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2015-0986

ZDI-15-392

Affected Products

Moxa Vport Activex Sdk Plus

References · 6

• http://moxa.com/support/download.aspx?d_id=2114 · Patch
• https://zerodayinitiative.com/advisories/ZDI-15-392 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-0986 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-15-097-01 · Note
• http://securityfocus.com/bid/73960 · Note
• http://zerodayinitiative.com/advisories/ZDI-15-392 · Note