CVE-2014-0772 - CVE House
Back to Database
Status published Medium CVE-2014-0772

Advantech WebAccess File and Directory Information Exposure

Vulnerability Description

The BWOCXRUN.BwocxrunCtrl.1 control contains a method named OpenUrlToBufferTimeout. This method takes a URL as a parameter and returns its contents to the caller in JavaScript. The URLs are accessed in the security context of the current browser session. The control does not perform any URL validation and allows file:// URLs that access the local disk. The method can be used to open a URL (including file URLs) and read the URLs through JavaScript. This method could also be used to reach any arbitrary URL to which the browser has access.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-0772

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Andrea Micalizzi, aka rgod, Tom Gallagher, and an independent anonymous researcher working with HP’s Zero Day Initiative (ZDI)

References

More from Advantech

View All →
CVE-2025-67653
Advantech WebAccess/SCADA Path Traversal
Medium 5.3
CVE-2025-64302
Advantech DeviceOn/iEdge Cross-site Scripting
Medium 5.3
CVE-2025-62630
Advantech DeviceOn/iEdge Path Traversal
High 8.7
CVE-2025-59171
Advantech DeviceOn/iEdge Path Traversal
High 8.7
CVE-2025-58423
Advantech DeviceOn/iEdge Path Traversal
High 8.7

Affected Vendor

Affected Software

WebAccess
Vulnerable Versions:
0, 7.2

Timeline

Official Publish: April 12th, 2014
Last Modified: September 19th, 2025
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-538

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.