CVE-2014-0773

2014-04-1204:37:31

icscert

web.nvd.nist.gov

vulnerability

advantech webaccess

activex control

remote code execution

crafted argument

cve-2014-0773

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

6.9

Confidence

Low

EPSS

0.181

Percentile

96.2%

JSON

The CreateProcess method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to execute (1) setup.exe, (2) bwvbprt.exe, and (3) bwvbprtl.exe programs from arbitrary pathnames via a crafted argument, as demonstrated by a UNC share pathname.

Affected configurations

Nvd

Node

advantechadvantech_webaccessRange≤7.1

advantechadvantech_webaccessMatch5.0

advantechadvantech_webaccessMatch6.0

advantechadvantech_webaccessMatch7.0

VendorProductVersionCPE
advantechadvantech_webaccess*cpe:2.3:a:advantech:advantech_webaccess:*:*:*:*:*:*:*:*
advantechadvantech_webaccess5.0cpe:2.3:a:advantech:advantech_webaccess:5.0:*:*:*:*:*:*:*
advantechadvantech_webaccess6.0cpe:2.3:a:advantech:advantech_webaccess:6.0:*:*:*:*:*:*:*
advantechadvantech_webaccess7.0cpe:2.3:a:advantech:advantech_webaccess:7.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
advantech	advantech_webaccess	*	cpe:2.3:a:advantech:advantech_webaccess::::::::
advantech	advantech_webaccess	5.0	cpe:2.3:a:advantech:advantech_webaccess:5.0:::::::*
advantech	advantech_webaccess	6.0	cpe:2.3:a:advantech:advantech_webaccess:6.0:::::::*
advantech	advantech_webaccess	7.0	cpe:2.3:a:advantech:advantech_webaccess:7.0:::::::*