CVE-2014-1201 - Vulnerability Details - OpenCVE

Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with firmware 11.17.38-33_1D97A, and Edge3 LH340 series with firmware 11.19.85_1FE3A allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the HTTP_PORT parameter.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Lorex Technology	Edge2 Lh330 Firmware Edge3 Lh340 Firmware Edge\+ Lh320 Firmware Edge Lh310 Firmware
Lorextechnology	Edge Edge2 Edge3 Edge\+

Configuration 1 [-]

AND

cpe:2.3:a:lorex_technology:edge_lh310_firmware:7-35-28-1b26e:*:*:*:*:*:*:*

cpe:2.3:h:lorextechnology:edge:lh310:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:a:lorex_technology:edge3_lh340_firmware:11.19.85_1fe3a:*:*:*:*:*:*:*

cpe:2.3:h:lorextechnology:edge3:lh340:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:a:lorex_technology:edge2_lh330_firmware:11.17.38-33_1d97a:*:*:*:*:*:*:*

cpe:2.3:h:lorextechnology:edge2:lh330:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:a:lorex_technology:edge\+_lh320_firmware:7-35-28-1b26e:*:*:*:*:*:*:*

cpe:2.3:h:lorextechnology:edge\+:lh320:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://osvdb.org/101903
http://www.securityfocus.com/archive/1/530739/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/90223
https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-report.txt
https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-testcase.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2014-01-15T16:00:00

Updated: 2024-08-06T09:34:40.455Z

Reserved: 2014-01-07T00:00:00

Link: CVE-2014-1201

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2014-01-15T16:08:18.297

Modified: 2025-04-11T00:51:21.963

Link: CVE-2014-1201

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-01-09T00:00:00", "descriptions": [{"lang": "en", "value": "Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with firmware 11.17.38-33_1D97A, and Edge3 LH340 series with firmware 11.19.85_1FE3A allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the HTTP_PORT parameter."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-09T18:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20140110 [CVE -2014-1201] Lorex security DVR ActiveX control buffer overflow", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/530739/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-testcase.html"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-report.txt"}, {"name": "lorex-cve20141201-bo(90223)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90223"}, {"name": "101903", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/101903"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2014-1201", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with firmware 11.17.38-33_1D97A, and Edge3 LH340 series with firmware 11.19.85_1FE3A allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the HTTP_PORT parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20140110 [CVE -2014-1201] Lorex security DVR ActiveX control buffer overflow", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/530739/100/0/threaded"}, {"name": "https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-testcase.html", "refsource": "MISC", "url": "https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-testcase.html"}, {"name": "https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-report.txt", "refsource": "MISC", "url": "https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-report.txt"}, {"name": "lorex-cve20141201-bo(90223)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90223"}, {"name": "101903", "refsource": "OSVDB", "url": "http://osvdb.org/101903"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T09:34:40.455Z"}, "title": "CVE Program Container", "references": [{"name": "20140110 [CVE -2014-1201] Lorex security DVR ActiveX control buffer overflow", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/530739/100/0/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-testcase.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-report.txt"}, {"name": "lorex-cve20141201-bo(90223)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90223"}, {"name": "101903", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/101903"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2014-1201", "datePublished": "2014-01-15T16:00:00", "dateReserved": "2014-01-07T00:00:00", "dateUpdated": "2024-08-06T09:34:40.455Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lorex_technology:edge_lh310_firmware:7-35-28-1b26e:*:*:*:*:*:*:*", "matchCriteriaId": "6AD26D4B-EC3A-4997-8D56-539B9399886F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lorextechnology:edge:lh310:*:*:*:*:*:*:*", "matchCriteriaId": "429A0C80-AED3-4CFE-A2C1-88A095B0BA29", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lorex_technology:edge3_lh340_firmware:11.19.85_1fe3a:*:*:*:*:*:*:*", "matchCriteriaId": "3642678E-A727-49D0-92F6-290335ECD88D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lorextechnology:edge3:lh340:*:*:*:*:*:*:*", "matchCriteriaId": "786F19F5-9EB4-4AF1-B636-F4C47CA6A909", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lorex_technology:edge2_lh330_firmware:11.17.38-33_1d97a:*:*:*:*:*:*:*", "matchCriteriaId": "DAF6F020-5EE1-4242-B513-41868162FD38", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lorextechnology:edge2:lh330:*:*:*:*:*:*:*", "matchCriteriaId": "8A062DB8-4AD6-44F8-AC4D-5FD940736C04", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lorex_technology:edge\\+_lh320_firmware:7-35-28-1b26e:*:*:*:*:*:*:*", "matchCriteriaId": "3FFA0756-AB07-441B-9D5A-CCA338CD28DF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lorextechnology:edge\\+:lh320:*:*:*:*:*:*:*", "matchCriteriaId": "689A2308-F69F-45BF-86FB-0DA7CC391F2C", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with firmware 11.17.38-33_1D97A, and Edge3 LH340 series with firmware 11.19.85_1FE3A allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the HTTP_PORT parameter."}, {"lang": "es", "value": "Desbordamientos de pila en el control INetViewX ActiveX en Lorex Edge LH310 y Edge+ LH320 en las series con firmware 7-35-28-1B26E, Edge2 LH330 en las series con firmware 11.17.38-33_1D97A y Edge3 LH340 en las series con firmware 11.19.85_1FE3A, que permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda) y posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de una cadena larga en el par\u00e1metro HTTP_PORT."}], "id": "CVE-2014-1201", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-01-15T16:08:18.297", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/101903"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/530739/100/0/threaded"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90223"}, {"source": "cve@mitre.org", "url": "https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-report.txt"}, {"source": "cve@mitre.org", "url": "https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-testcase.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/101903"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/530739/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90223"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-report.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-testcase.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}