cbcvebase.
CVE-2015-2099
published 2021-07-22

CVE-2015-2099: Multiple buffer overflows in WebGate Control Center allow remote attackers to execute arbitrary code via unspecified vectors to the (1) GetRecFileInfo function…

PriorityP267high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
14.07%
96.1th percentile
Multiple buffer overflows in WebGate Control Center allow remote attackers to execute arbitrary code via unspecified vectors to the (1) GetRecFileInfo function in the FileConverter.FileConverterCtrl.1 control, (2) Login function in the LoginContoller.LoginControllerCtrl.1 control, or (3) GetThumbnail function in the WESPPlayback.WESPPlaybackCtrl.1 control.

Detection & IOCsextracted from sources · hover to see the quote

versionWebGate Control Center 4.8.7↗
  • →Monitor for exploitation of the GetThumbnail function in the WESPPlayback.WESPPlaybackCtrl.1 ActiveX control, which is vulnerable to a stack-based buffer overflow exploitable by remote attackers. ↗
  • →Monitor for exploitation of the Login function in the LoginContoller.LoginControllerCtrl.1 ActiveX control, which is vulnerable to a buffer overflow exploitable by remote attackers. ↗
  • →Monitor for exploitation of the GetRecFileInfo function in the FileConverter.FileConverterCtrl.1 ActiveX control, which is vulnerable to a buffer overflow exploitable by remote attackers. ↗
  • →Exploit proof-of-concept uses large buffer variables (buff1, buff2, nops) passed to the GetThumbnail ActiveX method, consistent with a classic stack overflow NOP-sled shellcode pattern; monitor for large argument strings passed to WESPPlayback ActiveX instantiation in browser processes. ↗
  • ·The NVD advisory describes the attack vectors as 'unspecified', limiting precise detection specificity beyond the named functions and controls. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.