First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2012-4700

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Multiple buffer overflows in an ActiveX control in PE3DO32A.ocx in IntegraXor SCADA Server 4.00 build 4250.0 and earlier allow remote attackers to execute arbitrary code via a crafted HTML document.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://ics-cert.us-cert.gov/pdf/ICSA-13-036-02.pdfUS Government Resource
http://www.integraxor.com/blog/security-issue-for-activex-enabled-browser-vulnerability-notePatch, Vendor Advisory
http://ics-cert.us-cert.gov/pdf/ICSA-13-036-02.pdfUS Government Resource
http://www.integraxor.com/blog/security-issue-for-activex-enabled-browser-vulnerability-notePatch, Vendor Advisory

Timeline

Published: Feb 8, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-47019.3Directory traversal vulnerability in Tridium Niagara AX 3.5, 3.6, and 3.7 allows remote attackers to read sensitive files, and consequently CVE-2012-470210.0360 Systems Maxx, Image Server Maxx, and Image Server 2000 have a hardcoded password for the root account, which makes it easier for remote CVE-2012-47036.1The Emerson DeltaV SE3006 through 11.3.1, DeltaV VE3005 through 10.3.1 and 11.x through 11.3.1, and DeltaV VE3006 through 10.3.1 and 11.x th CVE-2012-470410.0Array index error in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via a crafted packet.CVE-2012-470510.0Directory traversal vulnerability in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors CVE-2012-47067.8Integer signedness error in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to cause a denial of service via a crafted pac CVE-2012-470710.03S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors that trigger an out-of-bounds memory CVE-2012-470810.0Stack-based buffer overflow in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via a crafted pac CVE-2012-47096.9Invensys Wonderware InTouch HMI 2012 R2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers,CVE-2012-47109.3Invensys Wonderware Win-XML Exporter 1522.148.0.0 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, o CVE-2012-471110.0Buffer overflow in kingMess.exe 65.20.2003.10300 in WellinTech KingView 6.52, kingMess.exe 65.20.2003.10400 in KingView 6.53, and kingMess.e CVE-2012-47125.0Moxa EDR-G903 series routers with firmware before 2.11 have a hardcoded account, which allows remote attackers to obtain unspecified device