{"id":"CVE-2014-2364","aliases":["EUVD-2014-2401","GHSA-wc68-m5j4-wxr7"],"status":"published","title":"Advantech WebAccess Stack-Based Buffer Overflow","description":"Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.61384,"percentile":0.9917,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-119","CWE-121"],"published":"2014-07-19T01:00:00Z","modified":"2026-06-17T00:06:29Z","exploits":[{"source":"exploitdb","id":"EDB-34757","title":"Advantech Webaccess - dvs.ocx GetColor Buffer Overflow (Metasploit)","type":"remote","platform":"windows","date":"2014-09-24","verified":true,"url":"https://www.exploit-db.com/exploits/34757"},{"source":"metasploit","id":"exploit/windows/browser/advantech_webaccess_dvs_getcolor","title":"Advantech WebAccess dvs.ocx GetColor Buffer Overflow","type":"exploit","platform":"Windows","date":"2014-07-17","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/browser/advantech_webaccess_dvs_getcolor"}],"products":[{"vendor":"advantech","product":"advantech_webaccess"},{"vendor":"advantech","product":"webaccess"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-14-198-02"},{"url":"http://packetstormsecurity.com/files/128384/Advantech-WebAccess-dvs.ocx-GetColor-Buffer-Overflow.html","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://www.securityfocus.com/bid/68714","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit"]},{"url":"http://webaccess.advantech.com/"},{"url":"http://ics-cert.us-cert.gov/advisories/ICSA-14-198-02","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2364"},{"url":"http://webaccess.advantech.com"},{"url":"https://github.com/advisories/GHSA-wc68-m5j4-wxr7"}],"sources":{"cve":[{"id":"CVE-2014-2364","title":"Advantech WebAccess Stack-Based Buffer Overflow","description":"Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx.","status":"published","published":"2014-07-19T01:00:00Z","modified":"2025-10-06T17:52:36.174Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:33:43.883586Z"}],"euvd":[{"id":"EUVD-2014-2401","description":"Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx.","status":"published","published":"2014-07-19T01:00:00Z","modified":"2025-10-06T17:52:36Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high"}],"updated_at":"2026-11-02T20:31:35.828093Z"}],"ghsa":[{"id":"GHSA-wc68-m5j4-wxr7","title":"Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to...","description":"Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx.","status":"published","published":"2022-05-17T04:10:10Z","modified":"2025-10-06T18:31:01Z","cwes":["CWE-119","CWE-121"],"updated_at":"2026-11-02T15:03:52.40546Z"}],"nvd":[{"id":"CVE-2014-2364","description":"Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx.","status":"published","published":"2014-07-19T05:09:27.563Z","modified":"2026-06-17T00:06:29.04Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-121","CWE-119"],"updated_at":"2026-11-02T14:02:54.827864Z"}]}}