CVE-2014-2368 — Advantech WebAccess Unsafe ActiveX Control Marked Safe For Scripting

CVE-2014-2368

Advantech WebAccess Unsafe ActiveX Control Marked Safe For Scripting PUBLISHED

Description (CNA)

The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.

Affected (CNA)

Vendor / product	Versions
Advantech / WebAccess	affected 0 through 7.1; unaffected 7.2

CWE

CWE-623

References

https://www.cisa.gov/news-events/ics-advisories/icsa-14-198-02
http://webaccess.advantech.com/

ADP enrichment

CVE

No English description supplied.

http://ics-cert.us-cert.gov/advisories/ICSA-14-198-02