CVE-2015-2097

published 2015-03-09

CVE-2015-2097: Multiple buffer overflows in WebGate Embedded Standard Protocol (WESP) SDK allow remote attackers to execute arbitrary code via unspecified vectors to the (1)…

Priority P2 64 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

Multiple buffer overflows in WebGate Embedded Standard Protocol (WESP) SDK allow remote attackers to execute arbitrary code via unspecified vectors to the (1) LoadImage or (2) LoadImageEx function in the WESPMonitor.WESPMonitorCtrl.1 control, (3) ChangePassword function in the WESPCONFIGLib.UserItem control, Connect function in the (4) WESPSerialPort.WESPSerialPortCtrl.1 or (5) WESPPLAYBACKLib.WESPPlaybackCtrl control, or (6) AddID function in the WESPCONFIGLib.IDList control or a (7) long string to the second argument to the ConnectEx3 function in the WESPPLAYBACKLib.WESPPlaybackCtrl control.

Detection & IOCs extracted from sources · hover to see the quote

other WESPMonitor.WESPMonitorCtrl.1↗

other WESPCONFIGLib.UserItem↗

other WESPSerialPort.WESPSerialPortCtrl.1↗

other WESPPLAYBACKLib.WESPPlaybackCtrl↗

other WESPCONFIGLib.IDList↗

version WebGate WESP SDK 1.2↗

version WebGate eDVR Manager 2.6.4↗

• → Monitor for ActiveX control instantiation of WESPMonitor.WESPMonitorCtrl.1 with calls to LoadImage or LoadImageEx with oversized arguments — indicative of buffer overflow exploitation attempt. ↗
• → Monitor for ActiveX control instantiation of WESPCONFIGLib.UserItem with calls to ChangePassword containing oversized string arguments — stack overflow exploitation vector. ↗
• → Monitor for ActiveX control instantiation of WESPPLAYBACKLib.WESPPlaybackCtrl with calls to ConnectEx3 where the second argument is a long string — direct exploitation indicator. ↗
• → Monitor for ActiveX control instantiation of WESPCONFIGLib.IDList with calls to AddID containing oversized arguments — buffer overflow exploitation vector. ↗
• → Exploit PoC uses the string 'PraveenD' as a fixed argument value in Connect and ChangePassword calls; presence of this string in browser/ActiveX logs alongside WESP controls may indicate exploit activity. ↗
• → Exploit PoC for ChangePassword uses 'PraveenD' as the second argument (arg2); monitor for this fixed string in WESP ActiveX method calls. ↗

• · The NVD description lists exploitation vectors as 'unspecified vectors', limiting precise protocol-level detection; detection must rely on ActiveX control ProgID monitoring and argument length heuristics. ↗
• · Exploit PoC source code is truncated in the available documents; full shellcode and NOP sled payloads are not available for signature extraction. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119