CVE-2014-2364 in the critical feed json
Advantech WebAccess Stack-Based Buffer Overflow
published 2014-07-19 12 y ago modified 2026-06-17 4 mo ago also EUVD-2014-2401
- cvss
- 7.5
- version 2.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 61.4%
- EPSS 61.4% chance of exploitation in 30 days, percentile 99.1%
- public exploits
- 2
- Metasploit, Exploit-DB
Summary
Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx.
Patch / fix
- Advantech WebAccess 7.2
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
cisa ICSA-14-198-02 updated cvss 7.5
Advantech WebAccess Vulnerabilities
-
Advantech WebAccessaffected: mitigation
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
Timeline
- First public exploit (Metasploit exploit/windows/browser/advantech_webaccess_dvs_getcolor)
- Published
Exploit prediction
61.38% chance of exploitation in the next 30 days, higher than 99.1% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/windows/browser/advantech_webaccess_dvs_getcolor Advantech WebAccess dvs.ocx GetColor Buffer Overflow metasploit exploit, normal rank, 2014-07-17
- EDB-34757 Advantech Webaccess - dvs.ocx GetColor Buffer Overflow (Metasploit) remote, 2014-09-24
- packetstormsecurity.com http://packetstormsecurity.com/files/128384/Advantech-WebAccess-dvs.ocx-GetColor-Buffer-Overflow.html referenced PoC, tagged "exploit" by a source, unverified
- securityfocus.com http://www.securityfocus.com/bid/68714 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- Advantech WebAccess
Classification
References
-
packetstormsecurity.com
/files/128384/Advantech-WebAccess-dvs.ocx-GetColor-Buffer-Overflow.html
exploit
-
securityfocus.com
/bid/68714
vdb-entry, exploit
- cisa.gov /news-events/ics-advisories/icsa-14-198-02
- webaccess.advantech.com /
-
ics-cert.us-cert.gov
/advisories/ICSA-14-198-02
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2014-2364
- NVD CVE-2014-2364
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.