CVE-2014-0773
Published Apr 12, 2014
Last updated 11 years ago
Overview
- Description
- The CreateProcess method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to execute (1) setup.exe, (2) bwvbprt.exe, and (3) bwvbprtl.exe programs from arbitrary pathnames via a crafted argument, as demonstrated by a UNC share pathname.
- Source
- ics-cert@hq.dhs.gov
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 7.5
- Impact score
- 6.4
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- NVD-CWE-Other
Evaluator
- Comment
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
- Impact
- -
- Solution
- -
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:advantech:advantech_webaccess:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3D097D1E-9A02-40B0-93BD-163A11638118",
"versionEndIncluding": "7.1"
},
{
"criteria": "cpe:2.3:a:advantech:advantech_webaccess:5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "090C819C-5964-4158-80E6-2D4751A5E8BF"
},
{
"criteria": "cpe:2.3:a:advantech:advantech_webaccess:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7CF61F9C-360A-4B70-951D-8EE9CF6E55FA"
},
{
"criteria": "cpe:2.3:a:advantech:advantech_webaccess:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1082E1D5-AF49-431F-9172-98C2D2887C96"
}
],
"operator": "OR"
}
]
}
]