CVE-2014-0759

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Unquoted Windows search path vulnerability in Schneider Electric Floating License Manager 1.0.0 through 1.4.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-428

Affected software

Vendor	Product	Versions
Schneider Electric	Floating License Manager	>= V1.0.0, <= V1.4.0

References

http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-015-01Vendor Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-14-058-01
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-015-01Vendor Advisory
http://ics-cert.us-cert.gov/advisories/ICSA-14-058-01US Government Resource

Timeline

Published: Feb 28, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-07609.3The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocume CVE-2014-07617.1The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows remote attackers to cause a denial of service (infinite loop or process CVE-2014-07624.7The CG Automation Software DNP3 driver, used in the ePAQ-9410 Substation Gateway products, does not validate input correctly. An attacker c CVE-2014-07637.5An attacker using SQL injection may use arguments to construct queries without proper sanitization. The DBVisitor.dll is exposed through SO CVE-2014-07647.5By providing an overly long string to the NodeName parameter, an attacker may be able to overflow the static stack buffer. The attacker ma CVE-2014-07657.5To exploit this vulnerability, the attacker sends data from the GotoCmd argument to control. If the value of the argument is overly long, t CVE-2014-07667.5An attacker can exploit this vulnerability by copying an overly long NodeName2 argument into a statically sized buffer on the stack to ove CVE-2014-07677.5An attacker may exploit this vulnerability by passing an overly long value from the AccessCode argument to the control. This will overflow CVE-2014-07687.5An attacker may pass an overly long value from the AccessCode2 argument to the control to overflow the static stack buffer. The attacker ma CVE-2014-07699.3The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authe CVE-2014-07707.5By providing an overly long string to the UserName parameter, an attacker may be able to overflow the static stack buffer. The attacker ma CVE-2014-07715.0The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “OpenUrlToBuffer.” This method takes a URL as a parameter and returns its cont