CVE-2014-0766

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An attacker can exploit this vulnerability by copying an overly long NodeName2 argument into a statically sized buffer on the stack to overflow the static stack buffer. An attacker may use this vulnerability to remotely execute arbitrary code.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-121 CWE-119

Affected software

Vendor	Product	Versions
Advantech	WebAccess	<= 7.1

References

http://webaccess.advantech.com/
http://www.securityfocus.com/bid/66740
https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/66725

Timeline

Published: Apr 12, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-07677.5An attacker may exploit this vulnerability by passing an overly long value from the AccessCode argument to the control. This will overflow CVE-2014-07687.5An attacker may pass an overly long value from the AccessCode2 argument to the control to overflow the static stack buffer. The attacker ma CVE-2014-07699.3The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authe CVE-2014-07707.5By providing an overly long string to the UserName parameter, an attacker may be able to overflow the static stack buffer. The attacker ma CVE-2014-07715.0The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “OpenUrlToBuffer.” This method takes a URL as a parameter and returns its cont CVE-2014-07725.0The BWOCXRUN.BwocxrunCtrl.1 control contains a method named OpenUrlToBufferTimeout. This method takes a URL as a parameter and returns its CVE-2014-07737.5The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “CreateProcess.” This method contains validation to ensure an attacker cannot CVE-2014-07746.9Stack-based buffer overflow in the C++ sample client in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 - 3.35, TLXCDSTOFS33 - 3.35 CVE-2014-07777.8The Modbus slave/outstation driver in the OPC Drivers 1.0.20 and earlier in IOServer OPC Server allows remote attackers to cause a denial of CVE-2014-07785.0TCPUploader module listens on Port 10651/TCP for incoming connections. Exploitation of this vulnerability could allow a remote unauthentica CVE-2014-07796.8The PLC driver in ServerMain.exe in the Kepware KepServerEX 4 component in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R2 b CVE-2014-07809.8Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrativ