VulnerabilityModified

CVE-2014-0768

An attacker may pass an overly long value from the AccessCode2 argument to the control to overflow the static stack buffer.

HIGH 7.5EPSS 2.67%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An attacker may pass an overly long value from the AccessCode2 argument to the control to overflow the static stack buffer. The attacker may then remotely execute arbitrary code.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 2.67% probability · 85th percentile
CISA KEV: Not listed
Weakness: CWE-121, CWE-119
Affected: advantech/advantech webaccess
Source: ics-cert@hq.dhs.gov

References

http://webaccess.advantech.com/
http://www.securityfocus.com/bid/66740
https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/66732

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.