CVE-2014-0773
Advantech WebAccess bwocxrun.ocx CreateProcess Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The CreateProcess method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to execute (1) setup.exe, (2) bwvbprt.exe, and (3) bwvbprtl.exe programs from arbitrary pathnames via a crafted argument, as demonstrated by a UNC share pathname.
El método CreateProcess en el control BWOCXRUN.BwocxrunCtrl.1 ActiveX en bwocxrun.ocx en Advantech WebAccess anterior a 7.2 permite a atacantes remotos ejecutar programas (1) setup.exe, (2) bwvbprt.exe y (3) bwvbprtl.exe de nombres de rutas arbitrarios a través de un argumento manipulado, tal y como fue demostrado por un nombre de ruta compartida UNC.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the bwocxrun.ocx. The control exposes a scriptable method 'CreateProcess'. An attacker can exploit a flaw in the validation code within the method to execute arbitrary commands in the context of the browser.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2014-01-02 CVE Reserved
- 2014-04-12 CVE Published
- 2024-07-16 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 | Us Government Resource |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Advantech Search vendor "Advantech" | Advantech Webaccess Search vendor "Advantech" for product "Advantech Webaccess" | <= 7.1 Search vendor "Advantech" for product "Advantech Webaccess" and version " <= 7.1" | - |
Affected
| ||||||
| Advantech Search vendor "Advantech" | Advantech Webaccess Search vendor "Advantech" for product "Advantech Webaccess" | 5.0 Search vendor "Advantech" for product "Advantech Webaccess" and version "5.0" | - |
Affected
| ||||||
| Advantech Search vendor "Advantech" | Advantech Webaccess Search vendor "Advantech" for product "Advantech Webaccess" | 6.0 Search vendor "Advantech" for product "Advantech Webaccess" and version "6.0" | - |
Affected
| ||||||
| Advantech Search vendor "Advantech" | Advantech Webaccess Search vendor "Advantech" for product "Advantech Webaccess" | 7.0 Search vendor "Advantech" for product "Advantech Webaccess" and version "7.0" | - |
Affected
| ||||||