VulnerabilityModified

CVE-2014-0767

An attacker may exploit this vulnerability by passing an overly long value from the AccessCode argument to the control.

HIGH 7.5EPSS 2.67%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An attacker may exploit this vulnerability by passing an overly long value from the AccessCode argument to the control. This will overflow the static stack buffer. The attacker may then execute code on the target device remotely.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 2.67% probability · 85th percentile
CISA KEV: Not listed
Weakness: CWE-121, CWE-119
Affected: advantech/advantech webaccess
Source: ics-cert@hq.dhs.gov

References

http://webaccess.advantech.com/
http://www.securityfocus.com/bid/66740
https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/66728

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.