Vulnerability Description
Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with firmware 11.17.38-33_1D97A, and Edge3 LH340 series with firmware 11.19.85_1FE3A allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the HTTP_PORT parameter.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Lorex Technology | Edge Lh310 Firmware | 7-35-28-1b26e |
| Lorextechnology | Edge | lh310 |
| Lorex Technology | Edge3 Lh340 Firmware | 11.19.85_1fe3a |
| Lorextechnology | Edge3 | lh340 |
| Lorex Technology | Edge2 Lh330 Firmware | 11.17.38-33_1d97a |
| Lorextechnology | Edge2 | lh330 |
| Lorex Technology | Edge\+ Lh320 Firmware | 7-35-28-1b26e |
| Lorextechnology | Edge\+ | lh320 |
Related Weaknesses (CWE)
References
- http://osvdb.org/101903
- http://www.securityfocus.com/archive/1/530739/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90223
- https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-report.txt
- https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-testcase.html
- http://osvdb.org/101903
- http://www.securityfocus.com/archive/1/530739/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90223
- https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-report.txt
- https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-testcase.html
FAQ
What is CVE-2014-1201?
CVE-2014-1201 is a vulnerability with a CVSS score of 10.0 (HIGH). Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with firmware 11.17.38-33_1D97A, and Edge3 LH340 series ...
How severe is CVE-2014-1201?
CVE-2014-1201 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-1201?
Check the references section above for vendor advisories and patch information. Affected products include: Lorex Technology Edge Lh310 Firmware, Lorextechnology Edge, Lorex Technology Edge3 Lh340 Firmware, Lorextechnology Edge3, Lorex Technology Edge2 Lh330 Firmware.