CVE-2014-3913 in the critical feed json
Stack-based buffer overflow in AccessServer32.exe in Ericom AccessNow Server allows remote attackers to execute arbitrary code via a reques…
published 2014-06-04 12 y ago modified 2026-06-17 4 mo ago also EUVD-2014-3850
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 60.9%
- EPSS 60.9% chance of exploitation in 30 days, percentile 99.1%
- public exploits
- 2
- Metasploit, Exploit-DB
Summary
Stack-based buffer overflow in AccessServer32.exe in Ericom AccessNow Server allows remote attackers to execute arbitrary code via a request for a non-existent file.
Timeline
- First public exploit (Metasploit exploit/windows/http/ericom_access_now_bof)
- Published
Exploit prediction
60.86% chance of exploitation in the next 30 days, higher than 99.1% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/windows/http/ericom_access_now_bof Ericom AccessNow Server Buffer Overflow metasploit exploit, normal rank, 2014-06-02
- EDB-33817 Ericom AccessNow Server - Remote Buffer Overflow (Metasploit) remote, 2014-06-19
- packetstormsecurity.com http://packetstormsecurity.com/files/127152/Ericom-AccessNow-Server-Buffer-Overflow.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
Sources
- CVE List CVE-2014-3913
- NVD CVE-2014-3913
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.