CVE-2015-2098

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 14%

from disclosure to weapon0 days

Published on NVDJul 22

1st PoCMar 27

exploitation probability

14%top 4% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to execute arbitrary code via unspecified vectors to the (1) Connect, (2) ConnectEx, or (3) ConnectEx2 function in the WESPEvent.WESPEventCtrl.1 control; (4) AudioOnlySiteChannel function in the WESPPlayback.WESPPlaybackCtrl.1 control; (5) Connect or (6) ConnectEx function in the WESPPTZ.WESPPTZCtrl.1 control; (7) SiteChannel property in the WESPPlayback.WESPPlaybackCtrl.1 control; (8) SiteName property in the WESPPlayback.WESPPlaybackCtrl.1 control; or (9) OpenDVrSSite function in the WESPPTZ.WESPPTZCtrl.1 control.

Affected products

n/a · n/a

public PoCs found — 3✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/36603 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/36606 exploitdbwww.exploit-db.com/exploits/36519unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://www.zerodayinitiative.com/advisories/ZDI-15-058/http://www.zerodayinitiative.com/advisories/ZDI-15-060/http://www.zerodayinitiative.com/advisories/ZDI-15-061/http://www.zerodayinitiative.com/advisories/ZDI-15-064/http://www.zerodayinitiative.com/advisories/ZDI-15-065/http://www.zerodayinitiative.com/advisories/ZDI-15-066/