Description
Multiple buffer overflows in the PocketNetNVRMediaClientAxCtrl.NVRMediaViewer.1 control in 3S Pocketnet Tech VMS allow remote attackers to execute arbitrary code via a crafted string to the (1) StartRecord, (2) StartRecordEx, (3) StartScheduledRecord, (4) SetDisplayText, (5) GetONVIFDeviceInformation, (6) GetONVIFProfiles, or (7) GetONVIFStreamUri method or a crafted filename to the (8) SaveCurrentImage or (9) SaveCurrentImageEx method.
References (6)
Core 6
Core References
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-14-396/
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-14-395/
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-14-394/
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-14-393/
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/71488
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-14-397/
Scores
EPSS
0.0381
EPSS Percentile
88.8%
Details
CWE
CWE-119
Status
published
Products (1)
3s_pocketnet_tech/3s_pocketnet_tech_video_management_software
Published
Dec 08, 2014
Tracked Since
Feb 18, 2026