CVE-2013-6127
published 2013-10-25CVE-2013-6127: The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict…
PriorityP346medium5.8CVSS 2.0
AVNACMAuNCNIPAP
EXPLOIT
EPSS
13.91%
96.1th percentile
The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict ReplaceDBFile method calls, which allows remote attackers to create or overwrite arbitrary files, and subsequently execute arbitrary programs, via the two pathname arguments, as demonstrated by a directory traversal attack.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wellintech | kingview | <= 6.53 | — |
| wellintech | kingview | — | — |
| wellintech | kingview | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
WellinTech KingView ActiveX Vulnerabilities
cisa_ics·2013-09-13
WellinTech KingView ActiveX Vulnerabilities
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
WellinTech KingView ActiveX Vulnerabilities
Last RevisedDecember 17, 2013
Alert CodeICSA-13-295-01
## OVERVIEW
This advisory is a follow-up to the alert titled ICS-ALERT-13-256-01 WellinTech KingView ActiveX VulnerabilitiesICS-ALERT-13-256-01 WellinTech KingView ActiveX Vulnerabilities, http://ics-cert.us-cert.gov/alerts/ICS-ALERT-13-256-01, Web site last accessed October 22, 2013. that was published September 13, 2013, on the NCCIC/ICS-CERT Web site.
Independent researcher “Blake” identified ActiveX vulnerabilities and released proof-of-concept (exploit) code for WellinTech Ki
GHSA
GHSA-wg24-f677-c248: The SUPERGRIDLib
ghsa_unreviewed·2022-05-17
CVE-2013-6127 [MEDIUM] CWE-22 GHSA-wg24-f677-c248: The SUPERGRIDLib
The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict ReplaceDBFile method calls, which allows remote attackers to create or overwrite arbitrary files, and subsequently execute arbitrary programs, via the two pathname arguments, as demonstrated by a directory traversal attack.
No detection rules found.
No writeups or analysis indexed.
2013-10-25
Published