Advantech WebAccess 7.2 < 7.2-2014.07.30 Multiple ActiveX RCE

The installed version of Advantech WebAccess 7.2 is prior to 7.2-2014.07.30 and is affected by the following vulnerabilities :

• An overflow condition exists in the ‘webvact.ocx’ ActiveX control due to improper validation of user-supplied input when handling the ‘NodeName’ parameter. A remote, unauthenticated attacker can exploit this to cause a stack-based buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2014-0985)
• An overflow condition exists in the ‘webvact.ocx’ ActiveX control due to improper validation of user-supplied input when handling the ‘GotoCmd’ parameter. A remote, unauthenticated attacker can exploit this to cause a stack-based buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2014-0986)
• An overflow condition exists in the ‘webvact.ocx’ ActiveX control due to improper validation of user-supplied input when handling the ‘NodeName2’ parameter. A remote, unauthenticated attacker can exploit this to cause a stack-based buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2014-0987)
• An overflow condition exists in the ‘webvact.ocx’ ActiveX control due to improper validation of user-supplied input when handling the ‘AccessCode’ parameter. A remote, unauthenticated attacker can exploit this to cause a stack-based buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2014-0988)
• An overflow condition exists in the ‘webvact.ocx’ ActiveX control due to improper validation of user-supplied input when handling the ‘AccessCode2’ parameter. A remote, unauthenticated attacker can exploit this to cause a stack-based buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2014-0989)
• An overflow condition exists in the ‘webvact.ocx’ ActiveX control due to improper validation of user-supplied input when handling the ‘UserName’ parameter. A remote, unauthenticated attacker can exploit this to cause a stack-based buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2014-0990)
• An overflow condition exists in an unspecified ActiveX control due to improper validation of user-supplied input when handling the ‘projectname’ parameter. A remote, unauthenticated attacker can exploit this to cause a stack-based buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2014-0991)
• An overflow condition exists in an unspecified ActiveX control due to improper validation of user-supplied input when handling the ‘password’ parameter. A remote, unauthenticated attacker can exploit this to cause a stack-based buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2014-0992)