WellinTech KingView ActiveX Multiple Arbitrary File Overwrite Vulnerabilities

medium Nessus Plugin ID 70292

Language:

Synopsis

The remote host has software installed that is affected by multiple arbitrary file overwrite vulnerabilities.

Description

The WellinTech KingView KChartXY.ocx and SuperGrid.ocx ActiveX controls installed on the remote host do not properly sanitize user input, which allows an attacker to overwrite arbitrary files.

Note that Nessus has not tested for these issues, but instead checked that the ActiveX controls were present on the machine.

Solution

Install the patches or implement one of the workarounds referenced in the vendor's advisory.

Plugin Details

Severity: Medium

ID: 70292

File Name: scada_kingview_activex.nbin

Version: 1.287

Type: local

Family: SCADA

Published: 10/3/2013

Updated: 11/12/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.2

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P

Vulnerability Information

CPE: cpe:/a:wellintech:kingview

Required KB Items: SMB/Registry/Enumerated

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/22/2013

Vulnerability Publication Date: 9/13/2013

Exploitable With

CANVAS (D2ExploitPack)

Reference Information

CVE: CVE-2013-6127, CVE-2013-6128

BID: 62419

ICS-ALERT: 13-256-01, 13-295-01

Detections

Analytics