{"cve":"CVE-2014-0773","nvd":{"published":"2014-04-12T04:37:31.707","modified":"2026-06-17T00:03:37.000","status":"Modified","description":"The BWOCXRUN.BwocxrunCtrl.1 control contains a method named \n“CreateProcess.” This method contains validation to ensure an attacker \ncannot run arbitrary command lines. After validation, the values \nsupplied in the HTML are passed to the Windows CreateProcessA API.\n\n\nThe validation can be bypassed allowing for running arbitrary command\n lines. The command line can specify running remote files (example: UNC \ncommand line).\n\n\nA function exists at offset 100019B0 of bwocxrun.ocx. Inside this \nfunction, there are 3 calls to strstr to check the contents of the user \nspecified command line. If “\\setup.exe,” “\\bwvbprt.exe,” or \n“\\bwvbprtl.exe” are contained in the command line (strstr returns \nnonzero value), the command line passes validation and is then passed to\n CreateProcessA.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-77"],"references":["http://webaccess.advantech.com/","http://www.securityfocus.com/bid/66740","https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03","http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03"],"products":["advantech:advantech_webaccess"],"source":"nvd","synced_at":"2026-10-19T20:32:06.812358378+00:00"},"epss":{"cve":"CVE-2014-0773","score":0.02519,"percentile":0.84841,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}