Introduction ********************************************************************************* Using Advantech WebAccess SCADA Software we can remotely manage Industrial Control systems devices like RTU's, Generators, Motors etc. Attackers can execute code remotely by passing maliciously crafted string to ConvToSafeArray API in ASPVCOBJLib.AspDataDriven ActiveX. Operating System: Windows SP1 Affected Product: Advantech WebAccess 8.0, 3.4.3 Vulnerable Program: AspVCObj.dll CVE-2014-9208 ********************************************************************************* Proof of Concept (PoC) for "Advantech WebAccess AspVCObj ActiveX UpdateProject Overflow Remote Code Execution" ********************************************************************************* ********************************************************************************* Proof of Concept (PoC) for "Advantech WebAccess AspVCObj ActiveX InterfaceFilter Overflow Remote Code Execution" ********************************************************************************* ********************************************************************************* Proof of Concept (PoC) for "Advantech WebAccess AspVCObj ActiveX FileProcess Overflow Remote Code Execution" ********************************************************************************* ********************************************************************************* Proof of Concept (PoC) for "Advantech WebAccess AspVCObj ActiveX GetWideStrCpy Overflow Remote Code Execution" ********************************************************************************* ********************************************************************************* Proof of Concept (PoC) for "Advantech WebAccess AspVCObj ActiveX GetRecipeInfo Overflow Remote Code Execution" ********************************************************************************* ********************************************************************************* Proof of Concept (PoC) for "Advantech WebAccess AspVCObj ActiveX GetLastTagNbr Overflow Remote Code Execution" ********************************************************************************* ********************************************************************************* Proof of Concept (PoC) for "Advantech WebAccess AspVCObj ActiveX ConvToSafeArray Overflow Remote Code Execution" ********************************************************************************* ********************************************************************************* Vulnerabilities were reported to Advantech sometime in January/February 2015, coordinated through CSOC.From April 2015 they has been postponing the fix. Best Regards, Praveen Darshanam