CVE-2014-3913: Ericom AccessNow Server stack buffer overflow via missing file request

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityNetwork-reachable, unauthenticated remote code execution with public exploit code and very high EPSS, though no KEV listing.

What it is

AccessServer32.exe in Ericom AccessNow Server contains a stack-based buffer overflow (CWE-119) triggered by a request for a non-existent file. A remote, unauthenticated attacker can send such a request to corrupt memory and potentially execute arbitrary code on the server. The flaw is severe because it is network-reachable with no authentication and no user interaction.

Impact

Successful exploitation allows remote code execution with full confidentiality, integrity and availability impact on the AccessNow Server host. An attacker could take over the service process and pivot into the environment it serves.

Attack surface

Reachable over the network via the AccessNow Server HTTP interface (AV:N/AC:L/Au:N), requiring no credentials and no user interaction. The trigger is a request for a file that does not exist.

Exploitation

Public exploit code exists (Packet Storm and Exploit-DB references tagged Exploit), and EPSS is 0.6086 (99.1st percentile), indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded here.

What to do

• Apply the vendor fix referenced in Ericom security advisory ERM-2014-610; if no supported version remains, migrate off AccessNow Server.
• Restrict network access to AccessServer32.exe/HTTP service to trusted hosts only, blocking exposure to the internet.
• Run the service under a least-privilege account and enable OS-level exploit mitigations (DEP, ASLR) where supported.
• Monitor vendor channels for end-of-life status and decommission unsupported deployments.

Detection

• Inspect AccessNow Server logs for requests to non-existent files, especially long or malformed paths, preceding a service crash or restart.
• Alert on AccessServer32.exe process crashes or unexpected restarts and correlate with inbound HTTP request logs.
• Use network monitoring to flag oversized or anomalous HTTP requests to the AccessNow service port.
• Watch for post-exploitation behavior such as new processes spawned by AccessServer32.exe.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.