CVE-2017-14016

moderate-risk
Published 2017-11-06

A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. The application lacks proper validation of the length of user-supplied data prior to copying it to a stack-based buffer, which could allow an attacker to execute arbitrary code under the context of the process.

Do I need to act?

!
19.2% chance of exploitation in next 30 days
EPSS score — higher than 81% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
43340
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Advantech

References (6)

Third Party Advisory http://www.securityfocus.com/bid/101685
Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-17-306-02
https://www.exploit-db.com/exploits/43340/
Third Party Advisory http://www.securityfocus.com/bid/101685
Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-17-306-02
https://www.exploit-db.com/exploits/43340/
49
/ 100
moderate-risk
Severity 23/34 · High
Exploitability 21/34 · High
Exposure 5/34 · Minimal