The BWOCXRUN.BwocxrunCtrl.1 control contains a method named OpenUrlToBufferTimeout. This method takes a URL as a parameter and returns its contents to the caller in JavaScript. The URLs are accessed in the security context of the current browser session. The control does not perform any URL validation and allows file:// URLs that access the local disk. The method can be used to open a URL (including file URLs) and read the URLs through JavaScript. This method could also be used to reach any arbitrary URL to which the browser has access.

The installed version of Advantech WebAccess is prior to 7.2-2013.11.14 and is affected by the following vulnerabilities :

 - Multiple SQL Injection vulnerabilities exist in 'DBVisitor.dll' that can be exploited via specially crafted SOAP requests. (CVE-2014-0763)
 - Multiple stack-based buffer overflow conditions exist in an unspecified ActiveX control. (CVE-2014-0764, CVE-2014-0765, CVE-2014-0766, CVE-2014-0767, CVE-2014-0768)
 - The 'NodeName' parameter on the web interface is affected by a buffer overflow vulnerability. (CVE-2014-0770)
 - An unspecified ActiveX control contains a flaw that allows attackers to read arbitrary files. (CVE-2014-0771, CVE-2014-0772)
 - An unspecified ActiveX control contains a flaw that allows certain executable names to be run from arbitrary path names. (CVE-2014-0773)

The remote host has a version of Advantech WebAccess prior to version 7.2-2013.11.14. It is, therefore, affected by  multiple vulnerabilities :

  - Multiple SQL Injection vulnerabilities exist in     'DBVisitor.dll' that can be exploited via specially     crafted SOAP requests. (CVE-2014-0763)

  - Multiple stack-based buffer overflow conditions exist in     an ActiveX control. (CVE-2014-0764, CVE-2014-0765,     CVE-2014-0766, CVE-2014-0767, CVE-2014-0768)

  - The 'NodeName' parameter on the web interface is     affected by a buffer overflow vulnerability.
    (CVE-2014-0770)

  - A flawed ActiveX control allows attackers to read     arbitrary files. (CVE-2014-0771, CVE-2014-0772)

  - A flawed ActiveX control allows certain executable     names to be run from arbitrary path names.
    (CVE-2014-0773)

The remote host has an ActiveX control (BWOCXRUN.OCX) installed that is affected by multiple vulnerabilities :

  - Multiple methods all allow remote attackers to read     arbitrary files. (CVE-2014-0771, CVE-2014-0772)

  - The CreateProcess method allows certain executable names     to be run from arbitrary path names. (CVE-2014-0773)

ID	Name	Product	Family	Severity
9957	Advantech WebAccess < 7.2-2013.11.14 Multiple Vulnerabilities	Nessus Network Monitor	SCADA	high
85411	Advantech WebAccess < 7.2-2013.11.14 Multiple Vulnerabilities	Nessus	SCADA	high
73641	Advantech WebAccess Multiple BWOCXRUN.OCX ActiveX Vulnerabilities	Nessus	SCADA	high

Detections

Analytics

CVE-2014-0772

medium

Tenable Plugins

high

high

high