CVE-2014-9263
Multiple buffer overflows in the PocketNetNVRMediaClientAxCtrl.NVRMediaViewer.1 control in 3S Pocketnet Tech VMS allow remote attackers to execute arbitrary code via a crafted string to the (1) StartRecord, (2) StartRecordEx, (3) StartScheduledRecord,…
Does this matter?
Lower severity and a low EPSS score (3.81%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple buffer overflows in the PocketNetNVRMediaClientAxCtrl.NVRMediaViewer.1 control in 3S Pocketnet Tech VMS allow remote attackers to execute arbitrary code via a crafted string to the (1) StartRecord, (2) StartRecordEx, (3) StartScheduledRecord, (4) SetDisplayText, (5) GetONVIFDeviceInformation, (6) GetONVIFProfiles, or (7) GetONVIFStreamUri method or a crafted filename to the (8) SaveCurrentImage or (9) SaveCurrentImageEx method.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 3.81% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- 3s pocketnet tech/3s pocketnet tech video management software
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/bid/71488
- http://www.zerodayinitiative.com/advisories/ZDI-14-393/
- http://www.zerodayinitiative.com/advisories/ZDI-14-394/
- http://www.zerodayinitiative.com/advisories/ZDI-14-395/
- http://www.zerodayinitiative.com/advisories/ZDI-14-396/
- http://www.zerodayinitiative.com/advisories/ZDI-14-397/
- http://www.securityfocus.com/bid/71488
- http://www.zerodayinitiative.com/advisories/ZDI-14-393/
- http://www.zerodayinitiative.com/advisories/ZDI-14-394/
- http://www.zerodayinitiative.com/advisories/ZDI-14-395/
- http://www.zerodayinitiative.com/advisories/ZDI-14-396/
- http://www.zerodayinitiative.com/advisories/ZDI-14-397/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.