CVE-2014-0766

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An attacker can exploit this vulnerability by copying an overly long NodeName2 argument into a statically sized buffer on the stack to overflow the static stack buffer. An attacker may use this vulnerability to remotely execute arbitrary code.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-121CWE-119

Affected software

No affected versions have been published.

Timeline

Published
Apr 12, 2014
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-07677.5An attacker may exploit this vulnerability by passing an overly long value from the AccessCode argument to the control. This will overflow CVE-2014-07687.5An attacker may pass an overly long value from the AccessCode2 argument to the control to overflow the static stack buffer. The attacker maCVE-2014-07699.3The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require autheCVE-2014-07707.5By providing an overly long string to the UserName parameter, an attacker may be able to overflow the static stack buffer. The attacker maCVE-2014-07715.0The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “OpenUrlToBuffer.” This method takes a URL as a parameter and returns its contCVE-2014-07725.0The BWOCXRUN.BwocxrunCtrl.1 control contains a method named OpenUrlToBufferTimeout. This method takes a URL as a parameter and returns itsCVE-2014-07737.5The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “CreateProcess.” This method contains validation to ensure an attacker cannot CVE-2014-07746.9Stack-based buffer overflow in the C++ sample client in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 - 3.35, TLXCDSTOFS33 - 3.35CVE-2014-07777.8The Modbus slave/outstation driver in the OPC Drivers 1.0.20 and earlier in IOServer OPC Server allows remote attackers to cause a denial ofCVE-2014-07785.0TCPUploader module listens on Port 10651/TCP for incoming connections. Exploitation of this vulnerability could allow a remote unauthenticaCVE-2014-07796.8The PLC driver in ServerMain.exe in the Kepware KepServerEX 4 component in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R2 bCVE-2014-07809.8Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrativ