Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on June 1, 2015, to address the vulnerability.
Moxa SoftCMS, en versiones 1.3 y anteriores, es susceptible a una condición de desbordamiento de búfer que podría cerrarse inesperadamente o permitir la ejecución remota de código. Moxa lanzó la versión 1.4 de SoftCMS el 1 de junio de 2015 para abordar esta vulnerabilidad.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Moxa SoftCMS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the AudioRecord method in the RTSPVIDEO ActiveX control. The implementation copies the user-supplied string for the ip parameter to a fixed-size stack buffer without validating its size, which can lead to a stack buffer overflow. An attacker can leverage this vulnerability to execute arbitrary code under the context of the process.
