Exploitation Summary
EIP tracks 1 public exploit for CVE-2019-25435. PoCs published by Alessandro Magnosi.
AI-analyzed exploit summary This is a functional local buffer overflow exploit for Sricam DeviceViewer 3.12.0.1, leveraging ROP chains to bypass DEP and execute arbitrary commands via WinExec. The exploit generates a malicious payload file that triggers a command shell when used as a username in the application's User Management feature.
Description
Sricam DeviceViewer 3.12.0.1 contains a local buffer overflow vulnerability in the user management add user function that allows authenticated attackers to execute arbitrary code by bypassing data execution prevention. Attackers can inject a malicious payload through the Username field in User Management to trigger a stack-based buffer overflow and execute commands via ROP chain gadgets.
Exploits (1)
This is a functional local buffer overflow exploit for Sricam DeviceViewer 3.12.0.1, leveraging ROP chains to bypass DEP and execute arbitrary commands via WinExec. The exploit generates a malicious payload file that triggers a command shell when used as a username in the application's User Management feature.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H