VulnerabilityModified

CVE-2014-0765

To exploit this vulnerability, the attacker sends data from the GotoCmd argument to control.

HIGH 7.5EPSS 2.67%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

To exploit this vulnerability, the attacker sends data from the GotoCmd argument to control. If the value of the argument is overly long, the static stack buffer can be overflowed. This will allow the attacker to execute arbitrary code remotely.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 2.67% probability · 85th percentile
CISA KEV: Not listed
Weakness: CWE-121, CWE-119
Affected: advantech/advantech webaccess
Source: ics-cert@hq.dhs.gov

References

http://webaccess.advantech.com/
http://www.securityfocus.com/bid/66740
https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/66722

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.