VulnerabilityModified

CVE-2014-0766

An attacker can exploit this vulnerability by copying an overly long NodeName2 argument into a statically sized buffer on the stack to overflow the static stack buffer.

HIGH 7.5EPSS 2.67%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An attacker can exploit this vulnerability by copying an overly long NodeName2 argument into a statically sized buffer on the stack to overflow the static stack buffer. An attacker may use this vulnerability to remotely execute arbitrary code.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 2.67% probability · 85th percentile
CISA KEV: Not listed
Weakness: CWE-121, CWE-119
Affected: advantech/advantech webaccess
Source: ics-cert@hq.dhs.gov

References

http://webaccess.advantech.com/
http://www.securityfocus.com/bid/66740
https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/66725

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.