CVE-2014-2364: Advantech WebAccess ActiveX controls stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote unauthenticated code execution in an industrial control product with public exploit code and very high EPSS, though not in KEV.

What it is

Advantech WebAccess before 7.2 contains multiple stack-based buffer overflows in its ActiveX controls (webvact.ocx, dvs.ocx, webdact.ocx). A long string passed to any of eleven parameters, including ProjectName, SetParameter, NodeName, CCDParameter, SetColor, AlarmImage, GetParameter, GetColor, ServerResponse, SetBaud, or IPAddress, can overwrite the stack. This is a remotely reachable code execution flaw in an industrial HMI/SCADA product.

Impact

An attacker can execute arbitrary code in the context of the process hosting the ActiveX control, typically the user's browser or WebAccess client. That yields full control of the affected workstation and a foothold into the industrial control network.

Attack surface

The flaw is reached over the network through the ActiveX controls, per the AV:N vector, with no authentication required (Au:N). Exploitation requires the victim to load a page or document that instantiates the vulnerable control, so some user interaction is implied by the ActiveX delivery model even though the record does not state it explicitly.

Exploitation

Public exploit code exists, as indicated by the Exploit tags on the Packet Storm and SecurityFocus references. The CVE is not listed in CISA KEV, but EPSS is 0.61384 (99.1st percentile), indicating a high likelihood of exploitation activity.

What to do

• Upgrade Advantech WebAccess to version 7.2 or later, which the advisory states fixes the issue.
• If immediate upgrade is not possible, disable or remove the vulnerable ActiveX controls (webvact.ocx, dvs.ocx, webdact.ocx) and block their instantiation.
• Restrict network access to WebAccess servers and clients so only trusted hosts can reach them.
• Configure browsers to prompt before running ActiveX controls and avoid visiting untrusted sites from WebAccess workstations.
• Apply the mitigations in CISA ICS advisory ICSA-14-198-02.

Detection

• Monitor for crashes or abnormal process termination in browsers or WebAccess client processes that host the ActiveX controls.
• Look for network traffic or file access patterns consistent with loading webvact.ocx, dvs.ocx, or webdact.ocx from unexpected sources.
• Search endpoint logs for child processes spawned by browser or WebAccess client processes, which may indicate successful code execution.
• Use the public exploit references to build signatures for the long-string parameter payloads against the affected controls.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.