{"id":"CVE-2014-0773","aliases":["EUVD-2014-0804","GHSA-wc8h-x86j-g2mp"],"status":"published","title":"Advantech WebAccess Command Injection","description":"The BWOCXRUN.BwocxrunCtrl.1 control contains a method named \n“CreateProcess.” This method contains validation to ensure an attacker \ncannot run arbitrary command lines. After validation, the values \nsupplied in the HTML are passed to the Windows CreateProcessA API.\n\n\nThe validation can be bypassed allowing for running arbitrary command\n lines. The command line can specify running remote files (example: UNC \ncommand line).\n\n\nA function exists at offset 100019B0 of bwocxrun.ocx. Inside this \nfunction, there are 3 calls to strstr to check the contents of the user \nspecified command line. If “\\setup.exe,” “\\bwvbprt.exe,” or \n“\\bwvbprtl.exe” are contained in the command line (strstr returns \nnonzero value), the command line passes validation and is then passed to\n CreateProcessA.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.02519,"percentile":0.84936,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77"],"published":"2014-04-12T01:00:00Z","modified":"2026-06-17T00:03:37Z","products":[{"vendor":"advantech","product":"advantech_webaccess"},{"vendor":"advantech","product":"webaccess"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03"},{"url":"http://www.securityfocus.com/bid/66740","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://webaccess.advantech.com/"},{"url":"http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03","tags":["x_refsource_MISC","x_transferred","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0773"},{"url":"http://webaccess.advantech.com"},{"url":"https://github.com/advisories/GHSA-wc8h-x86j-g2mp"}],"sources":{"cve":[{"id":"CVE-2014-0773","title":"Advantech WebAccess Command Injection","description":"The BWOCXRUN.BwocxrunCtrl.1 control contains a method named \n“CreateProcess.” This method contains validation to ensure an attacker \ncannot run arbitrary command lines. After validation, the values \nsupplied in the HTML are passed to the Windows CreateProcessA API.\n\n\nThe validation can be bypassed allowing for running arbitrary command\n lines. The command line can specify running remote files (example: UNC \ncommand line).\n\n\nA function exists at offset 100019B0 of bwocxrun.ocx. Inside this \nfunction, there are 3 calls to strstr to check the contents of the user \nspecified command line. If “\\setup.exe,” “\\bwvbprt.exe,” or \n“\\bwvbprtl.exe” are contained in the command line (strstr returns \nnonzero value), the command line passes validation and is then passed to\n CreateProcessA.","status":"published","published":"2014-04-12T01:00:00Z","modified":"2025-09-19T19:18:06.695Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:33:47.741012Z"}],"euvd":[{"id":"EUVD-2014-0804","description":"The BWOCXRUN.BwocxrunCtrl.1 control contains a method named \n“CreateProcess.” This method contains validation to ensure an attacker \ncannot run arbitrary command lines. After validation, the values \nsupplied in the HTML are passed to the Windows CreateProcessA API.\n\n\nThe validation can be bypassed allowing for running arbitrary command\n lines. The command line can specify running remote files (example: UNC \ncommand line).\n\n\nA function exists at offset 100019B0 of bwocxrun.ocx. Inside this \nfunction, there are 3 calls to strstr to check the contents of the user \nspecified command line. If “\\setup.exe,” “\\bwvbprt.exe,” or \n“\\bwvbprtl.exe” are contained in the command line (strstr returns \nnonzero value), the command line passes validation and is then passed to\n CreateProcessA.","status":"published","published":"2014-04-12T01:00:00Z","modified":"2025-09-19T19:18:06Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high"}],"updated_at":"2026-11-02T20:31:41.254663Z"}],"ghsa":[{"id":"GHSA-wc8h-x86j-g2mp","title":"The CreateProcess method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in...","description":"The CreateProcess method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to execute (1) setup.exe, (2) bwvbprt.exe, and (3) bwvbprtl.exe programs from arbitrary pathnames via a crafted argument, as demonstrated by a UNC share pathname.","status":"published","published":"2022-05-17T04:47:22Z","modified":"2025-09-19T21:32:19Z","cwes":["CWE-77"],"updated_at":"2026-11-02T15:03:40.313612Z"}],"nvd":[{"id":"CVE-2014-0773","description":"The BWOCXRUN.BwocxrunCtrl.1 control contains a method named \n“CreateProcess.” This method contains validation to ensure an attacker \ncannot run arbitrary command lines. After validation, the values \nsupplied in the HTML are passed to the Windows CreateProcessA API.\n\n\nThe validation can be bypassed allowing for running arbitrary command\n lines. The command line can specify running remote files (example: UNC \ncommand line).\n\n\nA function exists at offset 100019B0 of bwocxrun.ocx. Inside this \nfunction, there are 3 calls to strstr to check the contents of the user \nspecified command line. If “\\setup.exe,” “\\bwvbprt.exe,” or \n“\\bwvbprtl.exe” are contained in the command line (strstr returns \nnonzero value), the command line passes validation and is then passed to\n CreateProcessA.","status":"published","published":"2014-04-12T04:37:31.707Z","modified":"2026-06-17T00:03:37Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:02:53.710973Z"}]}}