CVE-2014-1201
Critical
Description
Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with firmware 11.17.38-33_1D97A, and Edge3 LH340 series with firmware 11.19.85_1FE3A allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the HTTP_PORT parameter.
SeverityCritical
CVSS10.0
Exploit probability—
ProductLorex Technology Edge Lh310 Firmware
PublishedJan 15, 2014
First seenJan 15, 2014
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lorex_technology edge_lh310_firmware | 7-35-28-1b26e | — |
| lorextechnology edge | lh310 | — |
| lorex_technology edge3_lh340_firmware | 11.19.85_1fe3a | — |
| lorextechnology edge3 | lh340 | — |
| lorex_technology edge2_lh330_firmware | 11.17.38-33_1d97a | — |
| lorextechnology edge2 | lh330 | — |
| lorex_technology edge\+_lh320_firmware | 7-35-28-1b26e | — |
| lorextechnology edge\+ | lh320 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.