{"id":"CVE-2014-2366","state":"PUBLISHED","title":"Advantech WebAccess Cleartext Storage of Sensitive Information in Memory","description":"upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code.","publishedAt":"2014-07-19T01:00:00.000Z","updatedAt":"2025-10-06T17:50:01.014Z","severity":{"score":9,"label":"Critical","version":"2.0","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","source":"icscert"},"assigner":"icscert","products":["Advantech WebAccess"],"affected":[{"vendor":"Advantech","product":"WebAccess","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"7.1","versionType":"custom"},{"version":"7.2","status":"unaffected"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-14-198-02","http://webaccess.advantech.com/","http://ics-cert.us-cert.gov/advisories/ICSA-14-198-02"],"weaknesses":["CWE-316"],"ingestedAt":"2026-10-29T19:41:14.331Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2014/2xxx/CVE-2014-2366.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2014-2366","state":"PUBLISHED","datePublished":"2014-07-19T01:00:00.000Z","dateUpdated":"2025-10-06T17:50:01.014Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2014-03-13T00:00:00.000Z"},"containers":{"cna":{"title":"Advantech WebAccess Cleartext Storage of Sensitive Information in Memory","descriptions":[{"lang":"en","value":"upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code."}],"affected":[{"vendor":"Advantech","product":"WebAccess","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"7.1","versionType":"custom"},{"version":"7.2","status":"unaffected"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-14-198-02"},{"url":"http://webaccess.advantech.com/","name":"68714"}],"metrics":[{"cvssV2_0":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"COMPLETE","baseScore":9,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","version":"2.0"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-316","description":"CWE-316","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2025-10-06T17:50:01.014Z"},"credits":[{"lang":"en","type":"finder","value":"reported to ZDI by security researchers Dave Weinstein, Tom Gallagher, John Leitch, and others"}],"datePublic":"2014-07-15T06:00:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Advantech released a new WebAccess Installation Package v7.2 on June \n6, 2014, that removes some vulnerable ActiveX components and resolves \nthe vulnerabilities within others. The download link for v7.2 is \navailable at:</p>\n<p><a target=\"_blank\" rel=\"nofollow\" href=\"http://webaccess.advantech.com/\">http://webaccess.advantech.com/</a></p>\n\n<br>"}],"value":"Advantech released a new WebAccess Installation Package v7.2 on June \n6, 2014, that removes some vulnerable ActiveX components and resolves \nthe vulnerabilities within others. The download link for v7.2 is \navailable at:\n\n\n http://webaccess.advantech.com/"}],"source":{"advisory":"ICSA-14-198-02","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"ics-cert@hq.dhs.gov","ID":"CVE-2014-2364","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://ics-cert.us-cert.gov/advisories/ICSA-14-198-02","refsource":"MISC","url":"http://ics-cert.us-cert.gov/advisories/ICSA-14-198-02"},{"name":"http://packetstormsecurity.com/files/128384/Advantech-WebAccess-dvs.ocx-GetColor-Buffer-Overflow.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/128384/Advantech-WebAccess-dvs.ocx-GetColor-Buffer-Overflow.html"},{"name":"68714","refsource":"BID","url":"http://www.securityfocus.com/bid/68714"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://ics-cert.us-cert.gov/advisories/ICSA-14-198-02","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-06T10:14:25.244Z"}}]}}}