CVE-2014-0764

By providing an overly long string to the NodeName parameter, an attacker may be able to overflow the static stack buffer. The attacker may then execute code on the target device remotely.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://webaccess.advantech.com/
http://www.securityfocus.com/bid/66740
https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03	Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/66718

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:advantech:advantech_webaccess::::::::
	cpe:2.3:a:advantech:advantech_webaccess:5.0:::::::*
	cpe:2.3:a:advantech:advantech_webaccess:6.0:::::::*
	cpe:2.3:a:advantech:advantech_webaccess:7.0:::::::*

History

19 Sep 2025, 19:15

Type	Values Removed	Values Added
References		() http://webaccess.advantech.com/ - () http://www.securityfocus.com/bid/66740 - () https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03 -
CWE		CWE-121
Summary	~~(en) Stack-based buffer overflow in Advantech WebAccess before 7.2 allows remote attackers to execute arbitrary code via a long NodeName parameter.~~	(en) By providing an overly long string to the NodeName parameter, an attacker may be able to overflow the static stack buffer. The attacker may then execute code on the target device remotely.

Information

Published : 2014-04-12 04:37

Updated : 2025-09-19 19:15

NVD link : CVE-2014-0764

Mitre link : CVE-2014-0764

CVE.ORG link : CVE-2014-0764

JSON object : View

Products Affected

advantech

advantech_webaccess

CWE

CWE-121

Stack-based Buffer Overflow

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

{"id": "CVE-2014-0764", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-04-12T04:37:31.470", "references": [{"url": "http://webaccess.advantech.com/", "source": "ics-cert@hq.dhs.gov"}, {"url": "http://www.securityfocus.com/bid/66740", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03", "source": "ics-cert@hq.dhs.gov"}, {"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/66718", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-121"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "By providing an overly long string to the NodeName parameter, an \nattacker may be able to overflow the static stack buffer. The attacker \nmay then execute code on the target device remotely."}, {"lang": "es", "value": "Desbordamiento de buffer basado en pila en Advantech WebAccess anterior a 7.2 permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de un par\u00e1metro NodeName largo."}], "lastModified": "2025-09-19T19:15:37.717", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:advantech:advantech_webaccess:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D097D1E-9A02-40B0-93BD-163A11638118", "versionEndIncluding": "7.1"}, {"criteria": "cpe:2.3:a:advantech:advantech_webaccess:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "090C819C-5964-4158-80E6-2D4751A5E8BF"}, {"criteria": "cpe:2.3:a:advantech:advantech_webaccess:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CF61F9C-360A-4B70-951D-8EE9CF6E55FA"}, {"criteria": "cpe:2.3:a:advantech:advantech_webaccess:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1082E1D5-AF49-431F-9172-98C2D2887C96"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}